General
-
Target
fbda851c43f7038c9670ec6b3ed27a034c75c3a4ef5e7cc4e8d49d3bea135e4b
-
Size
952KB
-
Sample
240128-bf6fcagag5
-
MD5
4eb66655d6e37627142a92e18ce05556
-
SHA1
7b92b310488de86f04dd73a057311cebdb6eb2bb
-
SHA256
fbda851c43f7038c9670ec6b3ed27a034c75c3a4ef5e7cc4e8d49d3bea135e4b
-
SHA512
27dfcf1eba49b83d9ac0c587523253266a87006b1d793e85225cc5d4efba715e3c2c87171402797b66104db53bc732f7c015560fe9860d7e62e7358bf42ec1db
-
SSDEEP
12288:Y0XCGPSX0zbyD+ndg+QCImGYUl9qyzlkE2kUNCPUBO/It26+Zqpxg0Z47dG1lFlo:CwE4MROxnFdCIrrcI0AilFEvxHjIQ4
Behavioral task
behavioral1
Sample
fbda851c43f7038c9670ec6b3ed27a034c75c3a4ef5e7cc4e8d49d3bea135e4b.exe
Resource
win7-20231129-en
Malware Config
Extracted
orcus
127.0.0.1:10134
5138bb95908b436792a5e79bb4d76281
-
autostart_method
Registry
-
enable_keylogger
true
-
install_path
%appdata%\Orcus\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
Orcus
-
watchdog_path
AppData\OrcusWatchdog.exe
Targets
-
-
Target
fbda851c43f7038c9670ec6b3ed27a034c75c3a4ef5e7cc4e8d49d3bea135e4b
-
Size
952KB
-
MD5
4eb66655d6e37627142a92e18ce05556
-
SHA1
7b92b310488de86f04dd73a057311cebdb6eb2bb
-
SHA256
fbda851c43f7038c9670ec6b3ed27a034c75c3a4ef5e7cc4e8d49d3bea135e4b
-
SHA512
27dfcf1eba49b83d9ac0c587523253266a87006b1d793e85225cc5d4efba715e3c2c87171402797b66104db53bc732f7c015560fe9860d7e62e7358bf42ec1db
-
SSDEEP
12288:Y0XCGPSX0zbyD+ndg+QCImGYUl9qyzlkE2kUNCPUBO/It26+Zqpxg0Z47dG1lFlo:CwE4MROxnFdCIrrcI0AilFEvxHjIQ4
-
Orcus main payload
-
Orcurs Rat Executable
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-