General
-
Target
09985fe4b9423da3b95aaa124c29f815222c5b2dfb18f48930740dd5447530d1
-
Size
916KB
-
Sample
220502-267zzaedcj
-
MD5
93417490d65898c9812f456f633ee70a
-
SHA1
93ccfecfb25c0fdcd4f9f5c2e35615b4745dc5ed
-
SHA256
09985fe4b9423da3b95aaa124c29f815222c5b2dfb18f48930740dd5447530d1
-
SHA512
0917fd6546c71eef2173a6326220ea5390ee043e38e0a0b738f2a65b2d847e143f717d88ea5f2d2fc1cdaa5190bf298fd4e7fd2ac62170bbeaa88a518123b785
Behavioral task
behavioral1
Sample
09985fe4b9423da3b95aaa124c29f815222c5b2dfb18f48930740dd5447530d1.exe
Resource
win7-20220414-en
Malware Config
Extracted
orcus
Spoofer
84.211.45.238:1085
8395b4f94fc143f0952b4dc3daa5a533
-
autostart_method
Registry
-
enable_keylogger
true
-
install_path
%programfiles%\Orcus\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
Windows Audio
-
taskscheduler_taskname
Windows
-
watchdog_path
AppData\OrcusWatchdog.exe
Targets
-
-
Target
09985fe4b9423da3b95aaa124c29f815222c5b2dfb18f48930740dd5447530d1
-
Size
916KB
-
MD5
93417490d65898c9812f456f633ee70a
-
SHA1
93ccfecfb25c0fdcd4f9f5c2e35615b4745dc5ed
-
SHA256
09985fe4b9423da3b95aaa124c29f815222c5b2dfb18f48930740dd5447530d1
-
SHA512
0917fd6546c71eef2173a6326220ea5390ee043e38e0a0b738f2a65b2d847e143f717d88ea5f2d2fc1cdaa5190bf298fd4e7fd2ac62170bbeaa88a518123b785
-
Orcus Main Payload
-
Orcurs Rat Executable
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Drops file in System32 directory
-