Overview

overview

10

Static

static

10

1407c316ae...ca.exe

windows7-x64

10

1407c316ae...ca.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1407c316ae266116eff2a7c2f40d8d3508dba301f8175d498be69c9d48a311ca

  • Size

    918KB

  • Sample

    240120-brqt2ahee9

  • MD5

    beff93c13a3839484a3248f3a1702516

  • SHA1

    77d2620d977c1b7730a599da82efd7360898f309

  • SHA256

    1407c316ae266116eff2a7c2f40d8d3508dba301f8175d498be69c9d48a311ca

  • SHA512

    fdf7ad1b65283101b1852badc92d09507a82eb13771d0676452f712fa26b649f20b18d970cf7c5f9bd43bf87b9252bd2ae76d9e11ef1addc0778565342a19a28

  • SSDEEP

    24576:k1I4MROxnFi3ArIrZlI0AilFEvxHi18D:k1rMioAMrZlI0AilFEvxHi

Score
10/10
orcushackratspywarestealer

Malware Config

Extracted

Family

orcus

Botnet

Hack

C2

127.0.0.1:10134

Mutex

d7904e4fe3184c208642abe8f5cf9293

Attributes
  • autostart_method

    TaskScheduler

  • enable_keylogger

    false

  • install_path

    C:\Windows\System32\tŠ°skmgr.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    GoogleUpdateTaskMachine

  • watchdog_path

    AppData\smss.exe

Targets

    • Target

      1407c316ae266116eff2a7c2f40d8d3508dba301f8175d498be69c9d48a311ca

    • Size

      918KB

    • MD5

      beff93c13a3839484a3248f3a1702516

    • SHA1

      77d2620d977c1b7730a599da82efd7360898f309

    • SHA256

      1407c316ae266116eff2a7c2f40d8d3508dba301f8175d498be69c9d48a311ca

    • SHA512

      fdf7ad1b65283101b1852badc92d09507a82eb13771d0676452f712fa26b649f20b18d970cf7c5f9bd43bf87b9252bd2ae76d9e11ef1addc0778565342a19a28

    • SSDEEP

      24576:k1I4MROxnFi3ArIrZlI0AilFEvxHi18D:k1rMioAMrZlI0AilFEvxHi

    Score
    10/10
    orcushackratspywarestealer

    • Orcus

      Orcus is a Remote Access Trojan that is being sold on underground forums.

      ratspywarestealerorcus

    • Orcus main payload

    • Orcurs Rat Executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops desktop.ini file(s)

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks