Behavioral task
behavioral1
Sample
1bc223aed315349c64f11e2c1b82c51ac13b270919a48bf8e799ae1bd45b17cc.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
1bc223aed315349c64f11e2c1b82c51ac13b270919a48bf8e799ae1bd45b17cc.exe
Resource
win10v2004-20240508-en
General
-
Target
1bc223aed315349c64f11e2c1b82c51ac13b270919a48bf8e799ae1bd45b17cc
-
Size
1.1MB
-
MD5
b03ab8a74cf59fc472a4789bf8140c7f
-
SHA1
90ca9a977bd349a589c539511b5ccfe2387169c0
-
SHA256
1bc223aed315349c64f11e2c1b82c51ac13b270919a48bf8e799ae1bd45b17cc
-
SHA512
d2d3e0b5e7a6f7358ace03d2ede2535ad5e5c7b68f8ce6a0112a0a2715850146f5d724f0f3824653724831bcb3c45587b6c79ad7765011cdefc85cdb0e55d321
-
SSDEEP
24576:91j4MROxnFE3FO3FrrcI0AilFEvxHPgWooLtW6pXcWSE+:9iMiuKFrrcI0AilFEvxHPg96VcWS
Malware Config
Extracted
orcus
In Silence
192.168.1.69:10134
a7fb4837861d40698b4e9e27bd20daa7
-
autostart_method
TaskScheduler
-
enable_keylogger
true
-
install_path
%programfiles%\Orcus\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
In Silence
-
watchdog_path
AppData\OrcusWatchdog.exe
Signatures
-
Orcurs Rat Executable 1 IoCs
Processes:
resource yara_rule sample orcus -
Orcus family
-
Orcus main payload 1 IoCs
Processes:
resource yara_rule sample family_orcus -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Processes:
resource 1bc223aed315349c64f11e2c1b82c51ac13b270919a48bf8e799ae1bd45b17cc
Files
-
1bc223aed315349c64f11e2c1b82c51ac13b270919a48bf8e799ae1bd45b17cc.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 921KB - Virtual size: 921KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 189KB - Virtual size: 188KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ