General
-
Target
946c3e0df5461146dc2385695c9ddce4b077247c9328f53085f4d6cc62ee10e1
-
Size
911KB
-
Sample
240126-bxc55abdg3
-
MD5
83f5f00042a3c0562187234a0249643c
-
SHA1
22a5a9f6843ed462db03f390dcd21fa4fa2a0639
-
SHA256
946c3e0df5461146dc2385695c9ddce4b077247c9328f53085f4d6cc62ee10e1
-
SHA512
8efa5067a2e0da9ecf648aadd2e2c352c81e8541f4450713d1f6682559806530b4b7b7dedd1fc82d1f6e46c6397ebbeaca5da5a52d4033396e0fbe7d82ecb30c
-
SSDEEP
24576:buQ4MROxnFl30sPePrZlI0AilFEvxHi5O6e:buzMirmrZlI0AilFEvxHi
Behavioral task
behavioral1
Sample
946c3e0df5461146dc2385695c9ddce4b077247c9328f53085f4d6cc62ee10e1.exe
Resource
win7-20231215-en
Malware Config
Extracted
orcus
2
malwaretest.ddns.net:1756
00d9e64f36144d099c4a811a31bdda21
-
autostart_method
Disable
-
enable_keylogger
true
-
install_path
%programfiles%\Orcus\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
Orcus
-
watchdog_path
AppData\OrcusWatchdog.exe
Targets
-
-
Target
946c3e0df5461146dc2385695c9ddce4b077247c9328f53085f4d6cc62ee10e1
-
Size
911KB
-
MD5
83f5f00042a3c0562187234a0249643c
-
SHA1
22a5a9f6843ed462db03f390dcd21fa4fa2a0639
-
SHA256
946c3e0df5461146dc2385695c9ddce4b077247c9328f53085f4d6cc62ee10e1
-
SHA512
8efa5067a2e0da9ecf648aadd2e2c352c81e8541f4450713d1f6682559806530b4b7b7dedd1fc82d1f6e46c6397ebbeaca5da5a52d4033396e0fbe7d82ecb30c
-
SSDEEP
24576:buQ4MROxnFl30sPePrZlI0AilFEvxHi5O6e:buzMirmrZlI0AilFEvxHi
-
Orcus main payload
-
Orcurs Rat Executable
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Drops desktop.ini file(s)
-