General
-
Target
f5ec9c818e5d515558f479915c1de23c803c55637825c6e8199760180bab866e.zip
-
Size
595KB
-
Sample
230321-r2kc1abc95
-
MD5
9e4c8752263f80b636d1249acd78fc5c
-
SHA1
0eb826257af21c8ab3855229f91f8ec32911584c
-
SHA256
30257f7538c093488cec42025711a59a5d7b9c4a6471bd22e2bedb24e26ba9ba
-
SHA512
4bba3a72f6b31ec13d6f1dfed57b1228919c791be62e40ec89320f399df18dabce576323a62a03fc185a725b21441ff462b2ea65f7199923eff3c3053f89f264
-
SSDEEP
12288:+vDODY2qr4BiqJXKJUCkIfxFthFxi/Wl2s0XAOE8CVRN8z:KCjMyZXiJfxFHFk/WlQXAOE8au
Behavioral task
behavioral1
Sample
f5ec9c818e5d515558f479915c1de23c803c55637825c6e8199760180bab866e.exe
Resource
win7-20230220-en
Malware Config
Extracted
orcus
84.21.172.55:1339
5e29a9dc07244cd5b38b6e685c293580
-
autostart_method
TaskScheduler
-
enable_keylogger
false
-
install_path
%programfiles%\Chrome\ChromeUpdateService.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
SmarterScreen
-
watchdog_path
AppData\WindowsToolKit.exe
Targets
-
-
Target
f5ec9c818e5d515558f479915c1de23c803c55637825c6e8199760180bab866e.exe
-
Size
916KB
-
MD5
1531ddf6b03ab9f7b0c46381210d82ca
-
SHA1
53f1566838a6e380e6f83e256ab7aac1e028f39f
-
SHA256
f5ec9c818e5d515558f479915c1de23c803c55637825c6e8199760180bab866e
-
SHA512
4ea19ccdccfc6532f9a71731df3766cc785d44e8cfabccb624cd99aae14efcb0c2925c9143b699fc6bc7f036c74d41ee476f56df247004a871d006d5e9f5d51e
-
SSDEEP
24576:ZVWC4MROxnFD3kw8XlrrcI0AilFEvxHPMrooG:ZqMiJorrcI0AilFEvxHP
-
Orcus main payload
-
Orcurs Rat Executable
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Drops file in System32 directory
-