A forum for reverse engineering, OS internals and malware analysis 

Backdoor:MSIL/Orcus

Forum for analysis and discussion about malware.

Re: Malware collection

 #32392  by EP_X0FF
 Tue Jan 08, 2019 5:54 am
markusg wrote: ↑Thu Sep 20, 2018 9:30 pm SHA-256
26e3ac4d81005556ccce5d912403bebd8423e47947abfc373b399ad375f35782
File name
wwe_2K18_installer.exe
https://www.virustotal.com/#/file/26e3a ... /detection
Backdoor Orcus written in C#.

Copy itself to %AppData%\Roaming\Microsoft\Windows\Start Menu\installer.exe

Obfuscated with Agile.NET, in attach deobfuscated (https://www.virustotal.com/en/file/195a ... 546927095/). Posts moved.
Attachments
pass: infected
(608.3 KiB) Downloaded 14 times
 Return to “Malware”