General
-
Target
Calculator14VGAexe.exe
-
Size
1.7MB
-
Sample
240109-w4sjlsfefl
-
MD5
4c969f76c5c1150669e1a54cfa20ed1c
-
SHA1
037f9b972c732222ba259754f75868caaefd03a3
-
SHA256
be235c670fa83853dfdd3c668df58da88289d2a8ef44e734fbc646f27cba9588
-
SHA512
5246dd5f6ee9c747360431bc140779a4d316af51186c6bcc0d6d0f3bb20e633cbdee2296432fd08e4f9234089bbcb5c868e8c9d75b05b523af53c5d34cc3ea15
-
SSDEEP
49152:ODQxkKWUoI8cQFrqxevo2NdQNBwLPVhF6WT:j2KWUoILC3nQDwrVn6WT
Static task
static1
Behavioral task
behavioral1
Sample
Calculator14VGAexe.exe
Resource
win7-20231215-en
Malware Config
Extracted
orcus
tg
10.0.2.15:6969
a867e8d19abf423285769fa6d8e47601
-
autostart_method
Registry
-
enable_keylogger
true
-
install_path
%programfiles%\Java8update\updaterjava9.exe
-
reconnect_delay
10000
-
registry_keyname
RobloxJavaMaster
-
taskscheduler_taskname
Orcus
-
watchdog_path
AppData\RobloxUpdater04.exe
Targets
-
-
Target
Calculator14VGAexe.exe
-
Size
1.7MB
-
MD5
4c969f76c5c1150669e1a54cfa20ed1c
-
SHA1
037f9b972c732222ba259754f75868caaefd03a3
-
SHA256
be235c670fa83853dfdd3c668df58da88289d2a8ef44e734fbc646f27cba9588
-
SHA512
5246dd5f6ee9c747360431bc140779a4d316af51186c6bcc0d6d0f3bb20e633cbdee2296432fd08e4f9234089bbcb5c868e8c9d75b05b523af53c5d34cc3ea15
-
SSDEEP
49152:ODQxkKWUoI8cQFrqxevo2NdQNBwLPVhF6WT:j2KWUoILC3nQDwrVn6WT
-
Orcurs Rat Executable
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory
-
Suspicious use of NtSetInformationThreadHideFromDebugger
-