Overview

overview

10

Static

static

BDCA302A43...0A.exe

windows7_x64

10

BDCA302A43...0A.exe

windows10_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    BDCA302A43DFD30F874CE13B2A20F4211E7BD88EBA40A.exe

  • Size

    789KB

  • Sample

    210731-hyxf5s8kk2

  • MD5

    75e95a530e5fe926bcca7c2c1a008e18

  • SHA1

    ff759b9abdd18c05b51509f92146a801f3fae939

  • SHA256

    bdca302a43dfd30f874ce13b2a20f4211e7bd88eba40a0c41f30873389133d3d

  • SHA512

    ad2cc5878b248cda26e5464dea496ea67ddd9bdf120c56dceee2581a167ae0771d19b68c19b62f4c487d045b0680c7d3892ba8aa99023e93b6391ea8d49821da

Score
10/10
orcus$evasionratspywarestealertrojan

Malware Config

Extracted

Family

orcus

Botnet

$

C2

lsdw.dyndns.org:10134

Mutex

bad69595827c48b5b9b2ea99aaff68b6

Attributes
  • autostart_method

    Disable

  • enable_keylogger

    true

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\OrcusWatchdog.exe

Targets

    • Target

      BDCA302A43DFD30F874CE13B2A20F4211E7BD88EBA40A.exe

    • Size

      789KB

    • MD5

      75e95a530e5fe926bcca7c2c1a008e18

    • SHA1

      ff759b9abdd18c05b51509f92146a801f3fae939

    • SHA256

      bdca302a43dfd30f874ce13b2a20f4211e7bd88eba40a0c41f30873389133d3d

    • SHA512

      ad2cc5878b248cda26e5464dea496ea67ddd9bdf120c56dceee2581a167ae0771d19b68c19b62f4c487d045b0680c7d3892ba8aa99023e93b6391ea8d49821da

    Score
    10/10
    orcus$evasionratspywarestealertrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Bypass User Account Control

1
T1088

Scheduled Task

1
T1053

Defense Evasion

Bypass User Account Control

1
T1088

Disabling Security Tools

1
T1089

Modify Registry

2
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks