Overview

overview

10

Static

static

10

cd42f90ac5...a4.exe

windows7_x64

10

cd42f90ac5...a4.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cd42f90ac522a1bf3a23764c700bbfa4.exe

  • Size

    903KB

  • Sample

    210502-nqza31eqke

  • MD5

    cd42f90ac522a1bf3a23764c700bbfa4

  • SHA1

    0caaca5d0f02fe988b7c6629271dfb325431b71c

  • SHA256

    3e4ef7b0224b4601e28838ec6319634315025d824c1404a2a9e114139dbdbe21

  • SHA512

    6a4155f288155cd9b2da52275e30dad56390b12060841eb20ad2a68b6ea8d426c699bb40bc4abc80c146ed46d2e9b000d9198a52c379e9b9ed32d73ed49401c5

Score
10/10
orcuspersistenceratspywarestealer

Malware Config

Extracted

Family

orcus

C2

185.163.47.163:10134

Mutex

4ad7857f77a347b49a5a7908a4f79070

Attributes
  • autostart_method

    Registry

  • enable_keylogger

    true

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\OrcusWatchdog.exe

Targets

    • Target

      cd42f90ac522a1bf3a23764c700bbfa4.exe

    • Size

      903KB

    • MD5

      cd42f90ac522a1bf3a23764c700bbfa4

    • SHA1

      0caaca5d0f02fe988b7c6629271dfb325431b71c

    • SHA256

      3e4ef7b0224b4601e28838ec6319634315025d824c1404a2a9e114139dbdbe21

    • SHA512

      6a4155f288155cd9b2da52275e30dad56390b12060841eb20ad2a68b6ea8d426c699bb40bc4abc80c146ed46d2e9b000d9198a52c379e9b9ed32d73ed49401c5

    Score
    10/10
    orcuspersistenceratspywarestealer

    • Orcus

      Orcus is a Remote Access Trojan that is being sold on underground forums.

      ratspywarestealerorcus

    • Orcus Main Payload

    • Orcurs Rat Executable

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Drops desktop.ini file(s)

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks