orcus | 111111111111111111111111111111222222222222222222222[.]exe

resource	yara_rule
sample	orcus

resource
111111111111111111111111111111222222222222222222222.exe
unpack001/aforge.video.directshow.dll
unpack001/aforge.video.dll
unpack001/costura.dll
unpack001/cscore.dll
unpack001/de.microsoft.win32.taskscheduler.resources.dll
unpack001/de.orcus.plugins.resources.dll
unpack001/de.orcus.staticcommands.resources.dll
unpack001/directoryinfoex.dll
unpack001/es.microsoft.win32.taskscheduler.resources.dll
unpack001/fluentcommandlineparser.dll
unpack001/fr.microsoft.win32.taskscheduler.resources.dll
unpack001/icsharpcode.sharpziplib.dll
unpack001/it.microsoft.win32.taskscheduler.resources.dll
unpack001/lidgren.network.dll
unpack001/microsoft.win32.taskscheduler.dll
unpack001/opuswrapper.dll
unpack001/orcus.plugins.dll
unpack001/orcus.shared.dll
unpack001/orcus.shared.utilities.dll
unpack001/orcus.staticcommands.dll
unpack001/pl.microsoft.win32.taskscheduler.resources.dll
unpack001/ru.microsoft.win32.taskscheduler.resources.dll
unpack001/sharpdx.direct3d11.dll
unpack001/sharpdx.direct3d9.dll
unpack001/sharpdx.dll
unpack001/sharpdx.dxgi.dll
unpack001/shelllibrary.dll
unpack001/starksoft.aspen.dll
unpack001/turbojpegwrapper.dll
unpack001/zh-CN.microsoft.win32.taskscheduler.resources.dll

111111111111111111111111111111222222222222222222222.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 e8d6b0abac094a449dc3b6860e9bde2d90be052d0476c513b8aa51cf23003cde
MD5 b483b8fc479ddd6996e01894226f3194
SHA1 e151db640a5ea8d4f2026954a481a98f74ba9b18
SHA512 5f86ec86c8da3d433857d165e19887c7a349484ba0098d434a54ea148f1dc236c44b88fcb3ac2fc82cbb80c4057b1cffc883976eda7f1a1f973a2781c27b7384
SSDEEP 49152:gtxIvljZeM9/Euj9aB50M5vu37RMoSKJh8AypQxb3o9JnCmsfGWncFfHIp4gJ31j:g3I9YLRf0MlSRMnKzypSb3o9JCms
TLSH
T148E512413FFCDD06D0BE2A79A57329C817B4EE029652EF4F0D51A14D0DAB741BE242AB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Orcurs Rat Executable
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

3110574

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

aforge.video.directshow.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 666d44798d94eafa1ed21af79e9bc0293ffd96f863ab5d87f78bcee9ef9ffd6b
MD5 17ed442e8485ac3f7dc5b3c089654a61
SHA1 d3a17c1fdd6d54951141053f88bf8238dea0b937
SHA512 9118bf11760354e9971ae8b27f7f6a405e46145b39ca6e6b413cb2e729e51304b895965e9140f66c9e3ef7caa4f344762bf059688b23dd32e4c2df271394fea2
SSDEEP 1536:XwumrikcyTpOKVi+Dqp6viPUCcvKWz3NTpAK+7KI4v8U:6dOKViKa6pOWbhpAKyKIVU
TLSH
T156535BA273B8C633C4AE17F6A4331F4017B1A7495223D79E1F9A519D7CB7B804A50B93
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Orcurs Rat Executable
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

67246

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\Andrew\AForge.NET\trunk\Sources\Video.DirectShow\obj\Release\AForge.Video.DirectShow.pdb

aforge.video.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 bafa6ed04ca2782270074127a0498dde022c2a9f4096c6bb2b8e3c08bb3d404d
MD5 0bd34aa29c7ea4181900797395a6da78
SHA1 ddffdcef29daddc36ca7d8ae2c8e01c1c8bb23a8
SHA512 a3734660c0aba1c2b27ab55f9e578371b56c82754a3b7cfd01e68c88967c8dada8d202260220831f1d1039a5a35bd1a67624398e689702481ac056d1c1ddcdb0
SSDEEP 384:Wu9f/hWFwLX+WJ7gfZLTswhHDlOdKaCxkyf0l:HfpZL9uxE9Cxd8l
TLSH
T135924C0AD31CC23FCB6E077EA472026287B0C3626643E7EA5CA951B9BC6736549437D7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Orcurs Rat Executable
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

26670

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\Andrew\AForge.NET\trunk\Sources\Video\obj\Release\AForge.Video.pdb

costura.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 9e0d68e4a15788ca1464ee024b3422cfdf8a68bc9058ad0d9c6bc91614935eed
MD5 d075a47a551e53e27889f83670a581e1
SHA1 5954e332ec7732ba34c27e2d88d154d1919c1b07
SHA512 d2f2ca4358102cb0d3cb90c1cebe9aa2cb2c6fb21facdf3471c50ab72d6ac907e789bb918508539c34c10fc948792c68f67363eb755b80a2343bd72dc9e93c0e
TLSH
T1CA81632193B8067AE9770FB29D7B03516375F921ED32C73F595561096C273248E72B32
MD5 SHA1 SHA512 TLSH

windows:4 windows x86 arch:x86

Orcurs Rat Executable
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10210

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\projects\costura\Costura\obj\Release\net40\Costura.pdb

cscore.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e835139171eb0d63b6b4e02b0997cac040c02d295648a275d4c8d28b234c8e94
MD5 94a312a6fcec0e78808bcea3d8ff67f5
SHA1 fe760487d13f9a6f5f359036561105d4aca88a1f
SHA512 ecdedeee1ee4e35e4fbd2dea3a4dd8b0805166a9610a63affbfb673f2644588eacecba6b3a5a0052c202ab14c321800997512abc318d36a50b00cc86dc83ec1c
SSDEEP 6144:qTOLDSWi9it6YQSJpAJNSgwB4dIiZsxFrRz0JfBT8hVNuNdrmh4K:oa2WR/YOBIORIJf84K
TLSH
T135B45A456BEC9A2BDE9E2F30F1B0445526B6E1822927EF8F588051FD0D93B834C71B67
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Orcurs Rat Executable
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

538286

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

de.microsoft.win32.taskscheduler.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 565a8e24a4de1227de966e932e4947ebe92ac027bbf4ebe4c7c0e78c1b1d0977
MD5 415a19242b5948106920adb3cd5de385
SHA1 884c3b02ee1d337182d77b45405b05d9f8c00c8e
SHA512 4576651d8930a0b7c88b3293909bb1fa4f7e73be8236441218027d7a3352a65127ae729f66b176d7b24b30608761ab5bd6748f15c78ca668913f082503ff1fb3
SSDEEP 192:QAxiWWNv/jzSENtqcadVl8PandjJUf7ZJSqSi/uf8v11X5rAg0XWr:QV1Nvb5adVl8P2djJMZJSGukH5rAg0Xq
TLSH
T17E122F499BF8063DF1F62FB9E9B68631B43AFD968D32D56D0240814D5930641CAF1B37
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Orcurs Rat Executable
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

14830

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

de.orcus.plugins.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 cb964dbccb5fd7abd65f9c34add427e549d04a15800b1bc2eb4beabf96824d1c
MD5 4a818bc54b202a5e7d3ad6fa0ed8ce33
SHA1 84af83654920bc9fe6de067c8f9e88dec3a275da
SHA512 4c37048788160210ba3d1b03ced6c4ebfce5eaa5248646c690bb0039679b27759b298ca9637f5a1874df97c1c5faa3b530f475dbe5928a8fc1ba62c3d2af87bd
SSDEEP 48:6I4BH2Z+7QcsfjGop30Nx0lt4c9oAIEAsAGxrd1haeEY9eHrML/UqD6nXKgYs:SBWyf0ltiAIEAsAsrd10THwLsLXK
TLSH
T10A91A74227EC0339F9B30F76AD7296801979FEB1AD72D72D1551416D2CB2A609DB0F32
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Orcurs Rat Executable
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

10142

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

de.orcus.staticcommands.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 fd3199e3f47c36a699746458d709bc4410469b8052505d5bbbef2541b246c57c
MD5 399c5f378c9b9e79718f6caab80d4372
SHA1 cbda83f2b6b7272d4ceddd0b7d5f840b37b649de
SHA512 12fb632460989c90526f0f04a65a4495c8f9c37d0a1fcf0eba85c0fdd0bc2b978730690bd5e2865438ff0c62ce99f71812c40771a67ffe346941ed75bd546836
SSDEEP 384:6Qj2OMqe/LVP77tWfcU36GAGwfMokgMzxoxEZQYUSFjONFm32:hajXMfyYUSFONFf
TLSH
T10EA2B601B7FD2219F8F31FB5AA79D5624CBABDF50C22E1AC2198508D18B1EA1C875733
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Orcurs Rat Executable
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

27214

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

directoryinfoex.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 b0a376e64303c66c4ef5147457caf0360d891ebd7676195db18f25b73c0398f6
MD5 9df56a69c09463589123e2416d97e48f
SHA1 da530f343fe3ffe7902a0fc93b884f634bfc4981
SHA512 aab9e957f9543537e6bea5d486a1be174e8f2193da612f5b7abd0048b48ba93059b8ddc78d8be1147025b301abd3075f286e38b9ed57c1b7825bf2648acb0ee9
SSDEEP 3072:vkwuCouJ5u1cmMLP1mrNSA3fI5txqVHRblFkx6l6QaPKZJGAiP2RroveF0TK:vkyLWF8NyV3mOVHaJQQ+4U0
TLSH
T152347D15B3E8A91AD68ED378E0E10E2A83F4D10971CBFB665AD4D6FA2D53380D5016F3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Orcurs Rat Executable
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

234210

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\Administrator\Desktop\OrcusSource\Libraries\DirectoryInfoEx\obj\Release\DirectoryInfoEx.pdb

directoryinfoex.pdb

SHA256 ac3b48db4badd08f3dd937e59df8f82fc1127c250bca046e421cf5581954e2ed
MD5 4a7935af2e2701c0dc94caf106ee645f
SHA1 ffd4186c111022619fc2baec65f80a3450f61bf5
SHA512 1193d0df2e986cbc5729d9c43174be8a51c4de108b8c336a80273dd002f62e9943e65ab71c773e38fec8fffa6543f6d6a74c666d13f4f23f04eccdf7f800b579
SSDEEP 6144:m4DASLtmTN9Ql/43xKSPax1rcY0jDX4BQkh:l0ebcY0j6
TLSH
T17CB4B617BF84DA32C465C17866DF8F1E0338D5885B43AB5F9382A12D7DE235E1E923A4
MD5 SHA1 SHA512 SSDEEP TLSH

Orcurs Rat Executable

es.microsoft.win32.taskscheduler.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d6124090ff17daaf7181e192bc026467677634f4a4842c8b1284cd012c7537fa
MD5 2f55c34aed1defe7877e64210f79dea6
SHA1 673911ea55c19175904ac8a077780478eeb46751
SHA512 cc26763debd5432acc8aca3399472fab5ae80aa20f1c0660cda66fa6181034cb62e96e6d72f961b39b32c6a201152d36c11413d54865603ccda2785740d5d7c6
SSDEEP 192:i5MaWWNv/jzSEStoC1vxx6hUltfxx+BE00cUnA82n1o5rAg0XWr:i5Ma1NvbGVxx6hUltfxgE00c4265rAgJ
TLSH
T168221F09ABF8463DF4F22FB9E9B6C022B83AFD959C32C65D4544824D1470685DAE1B33
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Orcurs Rat Executable
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

14958

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

fluentcommandlineparser.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e6124423367a9ec411176e2714c16a041c1a8b3e1691845040b57b0d779bef14
MD5 d0220eb32a8a631ca29f55929c7046cb
SHA1 553ec4ecc90676c7bb1de9f75a6b1226f39677aa
SHA512 63c2d7ac019d511751c57153bde64c5c57819a74ffbd1a893ea980211185296f018bc09980537394bb33e92508b4e14d87da8a6fba2ca87b820b9276d07a3445
SSDEEP 768:/WDesbk1hc+zloHIC/+9LXPnnx+N8iRnFidzsREmm:eDejkc9LnAzaIRS
TLSH
T1F5132B210BAC8F36CADF0679A874151A0BF9C7032552DB766E30F9E7195379389B23A1
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Orcurs Rat Executable
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

49310

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

z:\Builds\work\23f7f5f0221f789c\FluentCommandLineParser\obj\release\FluentCommandLineParser.pdb

fluentcommandlineparser.pdb

SHA256 2d812996cbdc1fdeddc1a9a9807e7dccae1708cc11def2c950fdb77261a0f21f
MD5 53c0253afa7cf1c2a0c13a4d01869504
SHA1 5753997682c6b57b8f8a946382220492d45665bd
SHA512 54d7d3da8fcc17ceb4446bb0a682dac1f85d68330ee5efe96b527d75a5b2a49a436e70a9272fc453738af7dc9111232b7bbee38468cbde74cb11ebde40090be8
SSDEEP 768:kvhMjucRacU9+lQUk7FWAEqeZjQv0tpn26Ks5VYrHxp:/ucRacRi7reZjqw2Z
TLSH
T1C5D36222BB48CB32C85A45BC6ECF8F0D4634EB470682EB5B5A95B55C3EB734A1D93344
MD5 SHA1 SHA512 SSDEEP TLSH

Orcurs Rat Executable

fr.microsoft.win32.taskscheduler.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 55dbc31a0e20a4d3c0e7c33f867baed7c7d693453349bf774fc5d8eb3e4c5d9d
MD5 11d2e6c3354d153b6472da2d435f424b
SHA1 6e038832884f58053d8bceb8e31bfa95e7d30094
SHA512 ee9d462c680ace513cddc99897c3ba6200ffd5519fcba4f13fe6887347b141301acc0d2b9f7b0e2aa1e0673056480d109cd93ad3302711a83994a1241a1f30bf
SSDEEP 192:0YWWNv/jzSEYtPpmKJiDjgmlRFI0HYZDKz/V8m1V5rAg0XWr:0Y1NvbdKJiDjgmlRi0HYZDfW5rAg0XWr
TLSH
T1F922211EABF8062DF5F22FB9E9728422F93AFDD59C32C5AD0644814D0571A41D6E2B33
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Orcurs Rat Executable
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

15198

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

icsharpcode.sharpziplib.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 40b3d590f95191f3e33e5d00e534fa40f823d9b1bb2a9afe05f139c4e0a3af8d
MD5 c8164876b6f66616d68387443621510c
SHA1 7a9df9c25d49690b6a3c451607d311a866b131f4
SHA512 44a6accc70c312a16d0e533d3287e380997c5e5d610dbeaa14b2dbb5567f2c41253b895c9817ecd96c85d286795bbe6ab35fd2352fddd9d191669a2fb0774bc4
SSDEEP 3072:hjMibqfQqFyGCDXiW9Pp/+Tl4abpuu201PB1BBXIDwtqSPVINrAfvp1:GibqI59PpOPf201/z7p
TLSH
T16E14061967FC4A5BF6EA4BB8E47524A5C3F0B966362ED74E8D8050FF1C127A0C825363
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Orcurs Rat Executable
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

196446

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

it.microsoft.win32.taskscheduler.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 78572b3f55bd9743315899e9589c89e7628fa410a6d9ee86a77475eafc65b01a
MD5 e2429f604a4b0039aa1b0ce1446f6d5a
SHA1 abef3ddf9a2649b1211034c7129c3f2181576b9f
SHA512 9a8979675ade5187c829b54691cf0c78dccf10ce976315c777f95142e3a39c9269e97b6f148b6514ddb1e5b9d02fd8e950d41e62c486be67ca26d7a0d5c0f7bb
SSDEEP 192:m4iWWNv/jzSE5tyT1TNgr1nJIhZAf/07m8z1ya5rAg0XWr:mn1NvbGTNgr1nJI3+07fJ5rAg0XWr
TLSH
T11E220F09ABFC462DF4F32FB9E9B68161B93AFD959C32C55D0644824D4870A81DAF1B33
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Orcurs Rat Executable
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

14846

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

lidgren.network.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 bf9948c27bd2947a42ea51ccc63b93f2b9030bd117393e1d7637a5770b9b0776
MD5 a6fdc03e2cbdfa9d393512606097a1ff
SHA1 c63933c082d282a284250deceb51d0d300647fe7
SHA512 2ec59fd17cd34741ab8d0ef0d8ef3533ef38b03e98d65bb1a19940349b16e47142b0d407946cb05bfc63d7859c1472c0906a72be0e1dcee0c170b80270ad6ca2
SSDEEP 3072:vmwfq+PlFS1gh72NkCM9eu3JcCDMFfXZkHhKQ6u80y8/ko1r8ApI9G:uaVh7CTu3iI/NJe
TLSH
T139C3391927E81A5BE3FF8ABEF430598107B0F552B62BE7DD595024FE09527D08822B73
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Orcurs Rat Executable
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

125602

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\Dokumente\GitHub\lidgren-network-gen3\Lidgren.Network\obj\Release\Lidgren.Network.pdb

microsoft.win32.taskscheduler.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 63e8ea2eb2550add2e9b06591e5573a8d6f59e93fa470d861847fe39b2c80293
MD5 132a0446dddb3bf0dc9cf4950ed1624d
SHA1 2933bb0bf2e455eaecfbf71533cc7851dd0dceb8
SHA512 7c3e0368e5b96fef983b06ea8e821bfa2ad6ecf0e5fc54c8bc15b60c77706af0b05929a2fba93d96424c856f5bafa066a32b7b705ed0da9e759ec64dac5f2bd4
SSDEEP 3072:F1sSJApTSnQU/x0ImhuDzHfs4zbYOjujDRfygDgKQINXLSHIaKlay8weCycJ5DfL:F1sSmRIt/xhtsOju1DH5NXYIKxc
TLSH
T141645A5167FCC32ADABF0B39E471021187B9F846A46FFB4DA980D59B5C237809922773
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Orcurs Rat Executable
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

339330

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\dahall\Documents\GitHubRepos\TaskScheduler\TaskService\obj\Release\net452\Microsoft.Win32.TaskScheduler.pdb

opuswrapper.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 5a320b3c5801647a5dd1e9657abb189e16a69d1ded96554cb498a89b3045bd00
MD5 ba4b0bafb568186b8c995e7c9415c47f
SHA1 ebfe91ba95cb4c8866d42d96b5a2f1904e798114
SHA512 05df90b538232b506ccd6b1c8966f1c3bfadfc4a97c6a1ef964d9af9e502dc6899621b91ac6f91f90174cb463d4067a183ae07e289fbe3299b2f2fbc2910a87a
SSDEEP 12288:d6wskteKPwaLStzL8tkjzUwsksX7GSWYMl7oeQOSYIDbjclvQMrox:oIteKc58aQ7GSW9NHVOPjcl7r
TLSH
T1B405AE01F2E2C5F5E076007462EAB78BB9383519032485F757D099699FB9BC05EFB3A2
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Orcurs Rat Executable
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

869934

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\Administrator\Desktop\OrcusSource\Libraries\OpusWrapper\obj\Release\OpusWrapper.pdb

opuswrapper.pdb

SHA256 f412cbfdb02d8f8807a76f8027bc08fdcdfc89cf687ab502ab3b38f8f15e8977
MD5 7a767f2f25c2e5012a1f8826e3ce7fbd
SHA1 cb4693f2d74f29cbe4ad5513dfdefcd3edfdadda
SHA512 dde223eca4f342a3e007b7477d172f4792f33a7a9148f96f7eb7b2cc40025d54f6195f7d28016cebda519bdd58d18b38eb14863d499d98e0a2a00c27df27bb58
SSDEEP 384:7KmEWiobWsDB4soNH3W1DWaX9dfLVWzhq56qbf:7KmEWiob3DB4soNH3WMaX9dktq56qbf
TLSH
T121F21C16FB85D632C455993E51DB8F0E4639EC049BC2774FA394B23DBEF23490E62268
MD5 SHA1 SHA512 SSDEEP TLSH

Orcurs Rat Executable

orcus.plugins.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 577032b8fee8752f94efc3b4cb7bc15bf5e9c8d8d86b86841db55efbdc305bc9
MD5 490c4756d568db665d322e14708c1fc6
SHA1 1cb4b02faf4c9cea30ff31dd191c00e574939cd7
SHA512 b508b4c4ddcd69da1062cf7b5e24453de4c77aab189801def70bc3468ee4856b969db7ef6b23977fdc437b215beea2d4db574798d2e26fccba6996ff65db7e7b
SSDEEP 768:aq9Cz87IysjcU83CDY6mVimzl3+vKu3cKxgl:IGT3kYfNzl3AKu3cKxgl
TLSH
T1FDE2095273FC873ECFBA0B36BC3153500A76D6C52972EB6A6B08AD191E6370501716B7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Orcurs Rat Executable
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

37358

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\Administrator\Desktop\OrcusSource\Orcus.Plugins\obj\Release\Orcus.Plugins.pdb

orcus.plugins.pdb

SHA256 6eaeec8c434b52653fbaa1604f45e2906747c785e1f35597562e564c9239c729
MD5 34575a5ec767ead9f2bc1517254e72b9
SHA1 7fc49c490d1da0c1394cf0bc771000a504a85460
SHA512 785f4a1e2558380f9d93365c24163b18033168a626cb409727180df8d3e553310b091910f448f4ea35534cc207394c8653bbf0fcdee9bbb75f011df076e9ca3b
SSDEEP 768:GdOVjKWnCvFWO2kXHFmVr+X6DzaWZ/2vKJat2wqHCm27fTsroSPcOD4QihhA/YIG:6/EYIUjJjt+Hm39vkoM94uTBp0cOo
TLSH
T137C3A30BFFC8DB31C464547945DA970E57B9EE449A80678FA328B238FEB15190E7236C
MD5 SHA1 SHA512 SSDEEP TLSH

Orcurs Rat Executable

orcus.shared.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 36886d50ba06ced427beeaf52491955b1d8d9e50f9573ded3d8812fb59d7abc6
MD5 078123c737e8c3d1289662365bcccc46
SHA1 29fe3d86c1ca48876b1fbb2528f7ae0494865564
SHA512 b644354f7aa07af81ff332bd6d763ae648b6c3c62d420a88faa1f6cfad14047e4797f22ba05851af1afdf04966e37fea56dcbbc4cc0d06e1f90981509777ed85
SSDEEP 6144:E8Nop8NagdmwWzRotzqj0LCZfgFoHQaCfDNKJb8PyUblrt/8A:EwoemJ0LCZVHQZfoJbg3blJkA
TLSH
T19C74E8272AFB812EE1B76EB5E5FC3C9B4A6FF6673601D4A9025057CE5703B02D940836
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Orcurs Rat Executable
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

363218

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\Administrator\Desktop\OrcusSource\Orcus.Shared\obj\Release\Orcus.Shared.pdb

orcus.shared.pdb

SHA256 fc1b8b5ac5aa08df93e7e0605ce977c23a8638d3eb20373738ddfe2a15766b0b
MD5 efbeb8e738dc70030d4dd5248ace0386
SHA1 b1c32e3b1169119daa19808b7436d2256954e7a7
SHA512 241ccc41e22f34213b7f8955fc1e23e62935a37c24d47c764d36f4c162fa93e0e55682334c96d4f3035ff1e9f043f7408db5dca5c4d732d23987a26428dd3967
SSDEEP 6144:mzaj21aQFieknS23oYv7XUdqp/aZT+CmCfZGqSrUIaMKRqXSCb7r/:Aaq1Jiet25zwqp/aACG7
TLSH
T1D505B507FF84CB36C0BA553A51EF970D1734E6448A80635BA754F138BFE460A6EA71E8
MD5 SHA1 SHA512 SSDEEP TLSH

Orcurs Rat Executable

orcus.shared.utilities.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 301ab0f06acea8e5fdfb7eac5a52eab3d0687520c9b89238d15ba230c2b4db3d
MD5 18c551edb64682961d7402880c29e9ae
SHA1 f3b5cc1fe8e3758aea8913f30f47dbaac323dd1d
SHA512 05fe5016d2d6a23d16f3726e37bf6a1ab1436d8ac9aa27be7b0c6f1f8f077d1ffa24d991364394d6391c8b3eba266e6dbb7087a4958658e0c99d96dd8f6d99c2
SSDEEP 768:c53jZB3t33As+aOtI9LxzQKcKzge1S1U+wJH2KB929+9HkPnk+44jUZx8A8W+hu9:c573PQe1H2GkPnExvR+hulY3+hu6
TLSH
T1E5234B15B7ACC327DA5D1B7CF8B4015503B0E197BA27EF7A6E88A06929573980D183F3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Orcurs Rat Executable
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

54738

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\Administrator\Desktop\OrcusSource\Orcus.Shared.Utilities\obj\Release\Orcus.Shared.Utilities.pdb

orcus.shared.utilities.pdb

SHA256 2850837d96de51bb441a2fc003202d6a015782f96bd9a3763d517d2f5fd3e50d
MD5 dad37943086a885065f04b93e8b444a4
SHA1 aaad4f894bc4316d59fb130db0ddca3888fa25f1
SHA512 d2754ec2a8b4a9efbcde5f9d7bec40e92bc68d0562f9960ef6235059bbf6841b46cfd9fbde2642c8fd76fca8f47c8982813f7d14083c8947fc5ae05ff17f3ed3
SSDEEP 1536:ZLTu2jLcW5P4SR0M4oa7CxBwKxtbaGs1:ZvLF+7CxBwKxxG
TLSH
T1DFD39517BF84C632C058C6756AEB5F0E5738EC44AF81575F6398B13CBEB630A1D912A8
MD5 SHA1 SHA512 SSDEEP TLSH

Orcurs Rat Executable

orcus.staticcommands.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 e23a80e4fcfe45ad1140210f04a99669d6a67d7c38973a1edc23c46519a17529
MD5 21702a0c014fff61fddfcd7e2b86bbf9
SHA1 71553d9bf5384f1acae96f1e91202e7b943d75f9
SHA512 75271ab3c10d7cd9441b6a23c6b4c3bcbce92bd7b18444345b37b418e0e2a6de9dc738791eb51753b13bdb3eaf2ac2cea1917ac1d449074cadcf3bd96d14fd5b
SSDEEP 1536:SWbzab+6x4FMp9bm5tNvIipLf1TcSUQ30:tDFMp9b6Ngip71TcSUQk
TLSH
T1E463610123FC522EF5BB0F786A3DD1A008B5BEF62D23E56E19E4648E4561F90D5707A3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Orcurs Rat Executable
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

78070

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\Administrator\Desktop\OrcusSource\Orcus.StaticCommands\obj\Release\Orcus.StaticCommands.pdb

orcus.staticcommands.pdb

SHA256 aeaf8ebb25460ccf536c306d4282a602a7fb1327e12cb0d2776c22f138f799a8
MD5 c0706b997aa0d36f4ab6d1e1fee76123
SHA1 2e6b543842f06ef5de5f6057ba0264c477ed1647
SHA512 f240b4bcdf3533c4cf43c05a8e2c5f58bce0df59d5ab78a975979a105c90a6e783354253fe1fc878e634ce34fac9989621ed6974d44201f60a4804a85c251a89
SSDEEP 1536:8vFQ0fbHAFKwokUolenhUDcxLlmPmX8FWT558vIWVDs6:EgFKGjlkhUDElmPmXzT558vIWDs
TLSH
T1E9D36317BFE8C636D49C493C1A9EC70C0678E7448681575FCBE1F4386EF139A1D6A298
MD5 SHA1 SHA512 SSDEEP TLSH

Orcurs Rat Executable

pl.microsoft.win32.taskscheduler.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 388dcde5e8d48ab345bccabfaaff03309f4b254eb6bbf15aab6ba69ab8e77f10
MD5 e3962c21118e1d5121dd554c3c09e05e
SHA1 b616f5838db821cc34a054a5c28aa6c0b8a3b22f
SHA512 815a9b32d4e52feaa57676a8513ad47ba5d805f3b73539dce49263929d83550923f113607ac0616c9dcd37c87d26205c3c5329c6acae0d4c93a824529747e744
SSDEEP 192:4RtWWNv/jzSEYtq2dE1cxy8ON0Qsk96s8l1I5rAg0XWr:4Rt1NvbaG1cxy8ONHskKQ5rAg0XWr
TLSH
T1A7221D19A7F8062EF5F22FB8E9B79132B87EFD958D22C65E0644811D4930641CAF1B37
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Orcurs Rat Executable
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

15118

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

ru.microsoft.win32.taskscheduler.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 f415bdecb0d4c7ca81f755ea87c926088ca894d38ad1d201261ff7d6668c7c10
MD5 a0b14d9646c63fe786f05570e0b2ed2e
SHA1 3e2a3ad711a1acb585d4ec040e97e4c5d01376fc
SHA512 1b6ada3eca41f80227288e89064d05bd74c0d865c9885310c4f22d7bc3cea51b180f65d6ed4666f09a0664c3099e49d2b762cd16061d9c7afaef54c2c385abf6
SSDEEP 192:z8qWWNv/jzSEfthb7O9JKggIOrCPPzm394in3fwB/CZ8lC1b5rAg0XWr:zD1NvbH7O9JKgglrCPChnYVCmy5rAg06
TLSH
T19F222E199BF8052DF4F26FB9F9769925B87AFDFA4E22C22D2100455D1871910C6F2B33
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Orcurs Rat Executable
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

15742

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

sharpdx.direct3d11.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d7617d926648849cbfef450b8f48e458ee52e2793fb2251a30094b778aa8848c
MD5 98eb5ba5871acdeaebf3a3b0f64be449
SHA1 c965284f60ef789b00b10b3df60ee682b4497de3
SHA512 a60025e304713d333e4b82b2d0be28087950688b049c98d2db5910c00b8d45b92e16d25ac8a58ff1318de019de3a9a00c7cbf8a6ad4b5bb1cb175dafa1b9bea2
SSDEEP 3072:6ccUvNf/AThDrcfiSDt0XN3ZDoyz91Sy0KwbwgG5OHDyGQsnHZ09K3vJqlQ1VcTS:zRfi+SmNgOHDyGQsucvJqW6Ts4dDjJZ
TLSH
T1F444E612DD465D0FC68F127EB4127A2743B08506489AF76FAC9C8C9E0FE63DC9A1A7C5
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Orcurs Rat Executable
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

283726

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\Downloads\desktop-duplication-net-master\desktop-duplication-net-master\libs\SharpDX.Direct3D11.pdb

sharpdx.direct3d9.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 02da4af8cd4a8de19d816000caaae885e676b9e52f136ff071a279c2b8ad34c7
MD5 934da0e49208d0881c44fe19d5033840
SHA1 a19c5a822e82e41752a08d3bd9110db19a8a5016
SHA512 de62f629c2299b50af62893244a28895d63b78138c8632449984306f45de16bd01076eadbb0d75a700215e970c1df731e202ea640236c0f0da6ed15146193b59
SSDEEP 6144:sF8TUNl4RaWH/EgJ2bOVbIbgiSC0EhS/:+8laWsgOOQHS
TLSH
T15B742B216F4AA723C74E2BBB98525D1CC334C202899FEB9F15E894710FC13958E5E6DB
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Orcurs Rat Executable
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

352142

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\Downloads\SharpDX-3.1.0\SharpDX-3.1.0\Source\NET35\SharpDX.Direct3D9\bin\Release\SharpDX.Direct3D9.pdb

sharpdx.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 061542ff3fb36039b7bbffdf3e07b66176b264c1dfd834a14b09c08620717303
MD5 ffb4b61cc11bec6d48226027c2c26704
SHA1 fa8b9e344accbdc4dffa9b5d821d23f0716da29e
SHA512 48aa6130bf1f5bd6de19256bbdf754c0158b43dd122cec47bb801a7a7b56f2da268bfdec24d135621764a23278ead3dcc35911a057e2dfa55a348bae8ef7b8a9
SSDEEP 6144:/yx2FKVw+6LRnencMdWqtFhdpGFfnbJoeeYr:6w+Ienc1qf6bJrd
TLSH
T167348C36DB5C0923CE8E47BEAC67011307F69204E116DB4F3A7564A929CB384AD6E7D3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Orcurs Rat Executable
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

258638

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\Downloads\SharpDX-3.1.0\SharpDX-3.1.0\Source\NET35\SharpDX\bin\Release\SharpDX.pdb

sharpdx.dxgi.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 3762d43c83af69cd38c9341a927ca6bd00f6bae8217c874d693047d6df4705bf
MD5 2b44c70c49b70d797fbb748158b5d9bb
SHA1 93e00e6527e461c45c7868d14cf05c007e478081
SHA512 faced62f6ecbfa2ee0d7a47e300302d23030d1f28758cbe9c442e9d8d4f8359c59088aa6237a28103e43d248c8efc7eeaf2c184028701b752df6cce92d6854d0
SSDEEP 1536:taSL4xpOaI0PXSgMkPXsHIrPQkrNCivO5Ib6VU3x8w85SMxcnqNojG5JW/UlibAs:taSLYpfI0fTtP8HIbQkreK
TLSH
T1E3C31F8A6F7187B1EA4F6FBE6652B92A6123F1110481735206D534004BB9253CFBFBDE
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Orcurs Rat Executable
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

134238

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

D:\Downloads\SharpDX-3.1.0\SharpDX-3.1.0\Source\NET35\SharpDX.DXGI\bin\Release\SharpDX.DXGI.pdb

shelllibrary.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 593db2ae0e99b40837054bd920cb4dbec63c28671c1bf56299e862be34137dd5
MD5 6c16473469d16242c12f50d578c7120e
SHA1 f466873cb7ad1c78f9e6c95d4fea59ac4d832589
SHA512 1bf3d56d60708e97d6811c4ef0490ef63c4694640a4765546ef8d078ab6d27fd10bbef04164bb6aef57c2cdc9aa538bd1998f3727286d061f083ad3b0ca2cd5a
SSDEEP 1536:BuxsMR2Voc5qep7+RnC+GYMqExYxEEYGir:B+m5B+PGYMnxz6a
TLSH
T1C3534B0377AC4A27C7DE837AECE52A0247B0C5977A23DF574B88E3991E427810945BB7
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Orcurs Rat Executable
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

71946

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

C:\Users\Administrator\Desktop\OrcusSource\Libraries\ShellLibrary\obj\Release\ShellLibrary.pdb

shelllibrary.pdb

SHA256 d8ba8ae43aba2fddb9971a0f77f095e834aa74fd92b2c0549400a1f8dbeacc84
MD5 f367ad3b46965562a79dfc8b29efddb1
SHA1 9d9fe03fa1ce704511ee24a05598ce6469c53da4
SHA512 86a77ba615809f9d8840879ec4d12b0fe9c020c3fbda46d134e05c163cc5b423da09ebd255c5c0148efb29ec41712847f70868571abe7df97eaeceddbeb0071f
SSDEEP 3072:UJX4kYEcRuUMg4S1wQOqOrKjGaZ/NNwjK9Igx4:gqOrFa
TLSH
T130C384177B84DA31C499C53819EB4F1E4238ED885B836B4FA399B1687DF33191F92368
MD5 SHA1 SHA512 SSDEEP TLSH

Orcurs Rat Executable

starksoft.aspen.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 0c52d8a203ba92de6f937a7d458c24854951761ccbbc8d3961bc2b7923239c7c
MD5 c2a974c1e5972d8772207ef8f9c5e39c
SHA1 11e2bcc91e20b982e7967c164053f57a2840fcb6
SHA512 b3250abaf92a2cd81b4eb0e2a0672532165547de90f389c52df61d4f518b8f58569b3d2e0c891dd6f04a6d96f078ba89ddf397d4f486982741bcfcdf4b19fb80
SSDEEP 768:QoCtkkseuWbDeK2dOBu9ISzsTPzHVZ6EMhI:HfkxfMoo98jzzShI
TLSH
T16D23F64537FC8623F7BF3B7498B15A52063ABDA29D33D72D5580A02E0C23B559871BA3
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Orcurs Rat Executable
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

42102

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\Dokumente\GitHub\starksoft-aspen\Starksoft.Aspen\obj\Release\starksoft.aspen.pdb

turbojpegwrapper.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 047b042cebf4c851f0d14f85f16ce952f03e48c20362d4ed9390875d4900fe96
MD5 ac6acc235ebef6374bed71b37e322874
SHA1 a267baad59cd7352167636836bad4b971fcd6b6b
SHA512 72ac8b8c8f27264cc261297c325d14a0be2084d007c6132ab8402d87f912fe9189cb074db11625d9f86d29a6188f22a89e58ae45c9131fac4522473567017081
SSDEEP 24576:UgKP0yiaiCSZMaW+bChn+ibsE/SZvp46xJ62bgYTqr:NbI+iapR/Tqr
TLSH
T145552757E5922CDADBE64074CDAED73267343A6C83F78BB3B11059E27D239E23A14604
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Orcurs Rat Executable
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

1368534

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DLL

PDB paths

D:\Dokumente\GitHub\AS.TurboJpegWrapper\LibJpegWrapper\obj\Release\TurboJpegWrapper.pdb

zh-CN.microsoft.win32.taskscheduler.resources.dll

IMPHASH dae02f32a21e03ce65412f6e56942daa
SHA256 d5fda68cc9c952bc130df28d1f9009af91daba3cf3aa3b24a5d3f21f08e8975b
MD5 93bb82562598278416974031e6063be1
SHA1 9c1342b5deabe20db481b609380a73524d495333
SHA512 a791486d4bfcf4b95ac79718d68a1f158b88ffb700e8a5c675ea8736767fe3b5efbb24f8f0a3d4f4c02f5b97fbee276bd42c7149b001e5baf9fcf71a6b8be5a1
SSDEEP 192:KlChWWNv/jzSEhtiBbSEmfO2mdqeCtzEc6yC8Vi1+5rAg0XWr:KlCh1NvbcbSEm22mdqet+Dz5rAg0XWr
TLSH
T13D12F04AA7FC0A2DF4F22FB8EAB68531B53AFD968C31C56E1550811C4971A41C9F1B33
MD5 SHA1 SHA512 SSDEEP TLSH

windows:4 windows x86 arch:x86

Orcurs Rat Executable
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

4

Entry point

14558

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE IMAGE_FILE_DLL

PDB paths

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

111111111111111111111111111111222222222222222222222.exe

mscoree

dotnet

aforge.video.directshow.dll

mscoree

dotnet

aforge.video.dll

mscoree

dotnet

costura.dll

mscoree

dotnet

cscore.dll

mscoree

dotnet

de.microsoft.win32.taskscheduler.resources.dll

mscoree

dotnet

de.orcus.plugins.resources.dll

mscoree

dotnet

de.orcus.staticcommands.resources.dll

mscoree

dotnet

directoryinfoex.dll

mscoree

dotnet

directoryinfoex.pdb

es.microsoft.win32.taskscheduler.resources.dll

mscoree

dotnet

fluentcommandlineparser.dll

mscoree

dotnet

fluentcommandlineparser.pdb

fr.microsoft.win32.taskscheduler.resources.dll

mscoree

dotnet

icsharpcode.sharpziplib.dll

mscoree

dotnet

it.microsoft.win32.taskscheduler.resources.dll

mscoree

dotnet

lidgren.network.dll

mscoree

dotnet

microsoft.win32.taskscheduler.dll

mscoree

dotnet

opuswrapper.dll

mscoree

dotnet

opuswrapper.pdb

orcus.plugins.dll

mscoree

dotnet

orcus.plugins.pdb

orcus.shared.dll

mscoree

dotnet

orcus.shared.pdb

orcus.shared.utilities.dll

mscoree

dotnet

orcus.shared.utilities.pdb

orcus.staticcommands.dll

mscoree

dotnet

orcus.staticcommands.pdb

pl.microsoft.win32.taskscheduler.resources.dll

mscoree

dotnet

ru.microsoft.win32.taskscheduler.resources.dll