General

  • Target

    tmp

  • Size

    18KB

  • Sample

    221002-s35k1ache9

  • MD5

    89ad448d079c97e6223bd48892a4c8b1

  • SHA1

    c864447470fe553ccbb0574f8596200c72283145

  • SHA256

    2ad50133104bbae5d82e85737296e39eecbfec15c270afd2a3b6aa981d53215f

  • SHA512

    ad594497d29d3eebddc6ca56bc9cd5ae64fd5c27fb1087634e198e846cdaa92fa60043ee64d9712b45d8833d7485c64f7bfab3a1cdbb3bee0c8d02125d47562c

Malware Config

Extracted

Family

orcus

C2

146.70.143.176:81

Attributes
autostart_method
Registry
enable_keylogger
false
install_path
%programfiles%\orc\orc.exe
reconnect_delay
10000
registry_keyname
orc
taskscheduler_taskname
orc
watchdog_path
AppData\Watchdog.exe

Targets

    • Target

      tmp

    • Size

      18KB

    • MD5

      89ad448d079c97e6223bd48892a4c8b1

    • SHA1

      c864447470fe553ccbb0574f8596200c72283145

    • SHA256

      2ad50133104bbae5d82e85737296e39eecbfec15c270afd2a3b6aa981d53215f

    • SHA512

      ad594497d29d3eebddc6ca56bc9cd5ae64fd5c27fb1087634e198e846cdaa92fa60043ee64d9712b45d8833d7485c64f7bfab3a1cdbb3bee0c8d02125d47562c

    • Orcus

      Orcus is a Remote Access Trojan that is being sold on underground forums.

    • Orcus main payload

    • PlagueBot

      PlagueBot is an open source Bot written in Pascal.

    • Orcurs Rat Executable

    • PlagueBot Executable

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Adds Run key to start application

    • Drops desktop.ini file(s)

    • Drops file in System32 directory

MITRE ATT&CK Matrix

Collection

    Command and Control

      Credential Access

        Defense Evasion

        Execution

          Exfiltration

            Impact

              Initial Access

                Lateral Movement

                  Privilege Escalation