General
-
Target
9f2151b2fd626d5139a7a292b4faffdedcc45346953b0ce71fa281615e6f350a.zip
-
Size
603KB
-
Sample
230321-r2jrgadd7y
-
MD5
7d343f2f5421f3f11c2c1723da499d00
-
SHA1
ce4bb41ccfcc4672e0dee6fa6537c8014170c712
-
SHA256
01f56f5b9cbf11c762203f02b75d7e8e6e4b3e07862d1e8f974df48f4d910746
-
SHA512
2b942ca6895561477a9d69b9f8396e9663a8872b34af7991a8a3061e4ab5771b70a101046963e673d25a52eb378cfce965f3175c5f8b96852f6e1cd39728c5c3
-
SSDEEP
12288:PgSKg//CRbFh8zkrUzuZpkTMsXSa9RQdLtyTDF:PHKqFzkYzs8DXCdLot
Behavioral task
behavioral1
Sample
9f2151b2fd626d5139a7a292b4faffdedcc45346953b0ce71fa281615e6f350a.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
9f2151b2fd626d5139a7a292b4faffdedcc45346953b0ce71fa281615e6f350a.exe
Resource
win10v2004-20230220-en
Malware Config
Extracted
orcus
147.185.221.229:56094
0a90560fd1de4ef0859fc02bececce78
-
autostart_method
Registry
-
enable_keylogger
true
-
install_path
%programfiles%\svhost\svhost.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
Orcus
-
watchdog_path
AppData\svhost.exe
Targets
-
-
Target
9f2151b2fd626d5139a7a292b4faffdedcc45346953b0ce71fa281615e6f350a.exe
-
Size
921KB
-
MD5
41394beb6f31b8215c7b9d0b8d412c3e
-
SHA1
c0436e7d59d3be57a1edc94ce52a5e03312aa368
-
SHA256
9f2151b2fd626d5139a7a292b4faffdedcc45346953b0ce71fa281615e6f350a
-
SHA512
dfd7ee246b53878037323ed246cf0aea90d43071a1499512e9db0b1b29376ab4cc09739ea03186839d47b7f2b54aa32c395eac4e67a6d32e7b37a78e4b5d9e1b
-
SSDEEP
24576:n6A4MROxnF43F9MQrrZlI0AilFEvxHihrTE:n6jMiG4wrZlI0AilFEvxHih
Score10/10-
Orcus main payload
-
Orcurs Rat Executable
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Drops file in System32 directory
-