General
-
Target
c14f668b4e0b8edf6cf88fcfd79d4dae670ece63c8e9722276edfda37e93a388
-
Size
924KB
-
Sample
220330-c87pjsfab2
-
MD5
b839522d2fdfce816353000008c22e35
-
SHA1
5ba45278759233bfec4f57a411bbef6f60ad5b5f
-
SHA256
c14f668b4e0b8edf6cf88fcfd79d4dae670ece63c8e9722276edfda37e93a388
-
SHA512
c2c167fbf7953b1268727d2bc55288db8fec9471adc8644432a283f7c7963f9ec3c98a5c8392aa4bc0d98738e947eb5e63f7cde73c660379124ec87101b5e295
Static task
static1
Behavioral task
behavioral1
Sample
c14f668b4e0b8edf6cf88fcfd79d4dae670ece63c8e9722276edfda37e93a388.exe
Resource
win7-20220310-en
Behavioral task
behavioral2
Sample
c14f668b4e0b8edf6cf88fcfd79d4dae670ece63c8e9722276edfda37e93a388.exe
Resource
win10v2004-20220331-en
Malware Config
Extracted
orcus
games
warframeclient.duckdns.org:7654
b92558ef339a44288243cca6a59b8471
-
autostart_method
TaskScheduler
-
enable_keylogger
false
-
install_path
%appdata%\gamez\generator.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
ss
-
watchdog_path
AppData\OrcusWatchdog.exe
Targets
-
-
Target
c14f668b4e0b8edf6cf88fcfd79d4dae670ece63c8e9722276edfda37e93a388
-
Size
924KB
-
MD5
b839522d2fdfce816353000008c22e35
-
SHA1
5ba45278759233bfec4f57a411bbef6f60ad5b5f
-
SHA256
c14f668b4e0b8edf6cf88fcfd79d4dae670ece63c8e9722276edfda37e93a388
-
SHA512
c2c167fbf7953b1268727d2bc55288db8fec9471adc8644432a283f7c7963f9ec3c98a5c8392aa4bc0d98738e947eb5e63f7cde73c660379124ec87101b5e295
-
Orcurs Rat Executable
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Suspicious use of SetThreadContext
-