orcus | 7da8336b47a47ac6c128b2bd13e1175791b33ba0c488c1ea9a2a933cd0d51831

General

Target

7da8336b47a47ac6c128b2bd13e1175791b33ba0c488c1ea9a2a933cd0d51831
Size

843KB
MD5

2cc12a9d19bf90e80af45bf3138491c6
SHA1

1f7bca251aa4f2e2f51f2b79ce0b6e8d052b7bd3
SHA256

7da8336b47a47ac6c128b2bd13e1175791b33ba0c488c1ea9a2a933cd0d51831
SHA512

648c25cc5c5ce440a0bc68bcffe205ada80fe697aa1f41ca56dfb817bbaf637db592b59b5b5ecf4b3d66a4535c01bd54ba900d9b2667233642ac9308579d39f4
SSDEEP

24576:bxYS04YNEMuExDiU6E5R9s8xY/2l/dlLbB83LIbt+rA:bxA4auS+UjfU2T1b63LIbt+r

Score

10^/10

rat orcus

Family

orcus

C2

82.117.87.72

Mutex

90061b9b1af04713be86c1c3e404bf64

Attributes

administration_rights_required
false
anti_debugger
false
anti_tcp_analyzer
false
antivm
false
autostart_method
1
change_creation_date
false
force_installer_administrator_privileges
false
hide_file
false
install
false
installation_folder
%appdata%\Microsoft\TiWorker.exe
installservice
false
keylogger_enabled
false
newcreationdate
05/01/2024 13:22:54
plugins
AgUFyfihswTdIPqEArukcmEdSF06Hw9CAFMAbwBEACAAUAByAG8AdABlAGMAdABpAG8AbgAHAzEALgAwAEEgNQBlAGIAOAA5ADUAMwA3ADYANQBkADIANABjADcAYgBiAGEAMgA3ADkAZQAzADIAMAA4ADgAMgA4AGYAMQA5AAEAAAACAg==
reconnect_delay
10000
registry_autostart_keyname
Audio HD Driver
registry_hidden_autostart
false
set_admin_flag
false
tasksch_name
Audio HD Driver
tasksch_request_highest_privileges
false
try_other_autostart_onfail
false

aes.plain

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
7da8336b47a47ac6c128b2bd13e1175791b33ba0c488c1ea9a2a933cd0d51831