Overview

overview

10

Static

static

3

75e95a530e...18.exe

windows7-x64

10

75e95a530e...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    75e95a530e5fe926bcca7c2c1a008e18

  • Size

    789KB

  • Sample

    240126-as8wkaade4

  • MD5

    75e95a530e5fe926bcca7c2c1a008e18

  • SHA1

    ff759b9abdd18c05b51509f92146a801f3fae939

  • SHA256

    bdca302a43dfd30f874ce13b2a20f4211e7bd88eba40a0c41f30873389133d3d

  • SHA512

    ad2cc5878b248cda26e5464dea496ea67ddd9bdf120c56dceee2581a167ae0771d19b68c19b62f4c487d045b0680c7d3892ba8aa99023e93b6391ea8d49821da

  • SSDEEP

    24576:eUM7cLQ/K+2KnKNrk/eXIXVXSOUKoNsxcv3:eb7c1NLEVXSOLoew

Score
10/10
orcus$evasionratspywarestealertrojan

Malware Config

Extracted

Family

orcus

Botnet

$

C2

lsdw.dyndns.org:10134

Mutex

bad69595827c48b5b9b2ea99aaff68b6

Attributes
  • autostart_method

    Disable

  • enable_keylogger

    true

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\OrcusWatchdog.exe

Targets

    • Target

      75e95a530e5fe926bcca7c2c1a008e18

    • Size

      789KB

    • MD5

      75e95a530e5fe926bcca7c2c1a008e18

    • SHA1

      ff759b9abdd18c05b51509f92146a801f3fae939

    • SHA256

      bdca302a43dfd30f874ce13b2a20f4211e7bd88eba40a0c41f30873389133d3d

    • SHA512

      ad2cc5878b248cda26e5464dea496ea67ddd9bdf120c56dceee2581a167ae0771d19b68c19b62f4c487d045b0680c7d3892ba8aa99023e93b6391ea8d49821da

    • SSDEEP

      24576:eUM7cLQ/K+2KnKNrk/eXIXVXSOUKoNsxcv3:eb7c1NLEVXSOLoew

    Score
    10/10
    orcus$evasionratspywarestealertrojan
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

1
T1053

Persistence

Scheduled Task/Job

1
T1053

Privilege Escalation

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Scheduled Task/Job

1
T1053

Defense Evasion

Abuse Elevation Control Mechanism

1
T1548

Bypass User Account Control

1
T1548.002

Impair Defenses

1
T1562

Disable or Modify Tools

1
T1562.001

Modify Registry

2
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks