General

  • Target

    fbda851c43f7038c9670ec6b3ed27a034c75c3a4ef5e7cc4e8d49d3bea135e4b

  • Size

    952KB

  • Sample

    240128-bf6fcagag5

  • MD5

    4eb66655d6e37627142a92e18ce05556

  • SHA1

    7b92b310488de86f04dd73a057311cebdb6eb2bb

  • SHA256

    fbda851c43f7038c9670ec6b3ed27a034c75c3a4ef5e7cc4e8d49d3bea135e4b

  • SHA512

    27dfcf1eba49b83d9ac0c587523253266a87006b1d793e85225cc5d4efba715e3c2c87171402797b66104db53bc732f7c015560fe9860d7e62e7358bf42ec1db

  • SSDEEP

    12288:Y0XCGPSX0zbyD+ndg+QCImGYUl9qyzlkE2kUNCPUBO/It26+Zqpxg0Z47dG1lFlo:CwE4MROxnFdCIrrcI0AilFEvxHjIQ4

Malware Config

Extracted

Family

orcus

C2

127.0.0.1:10134

Mutex

5138bb95908b436792a5e79bb4d76281

Attributes
  • autostart_method

    Registry

  • enable_keylogger

    true

  • install_path

    %appdata%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\OrcusWatchdog.exe

Targets

    • Target

      fbda851c43f7038c9670ec6b3ed27a034c75c3a4ef5e7cc4e8d49d3bea135e4b

    • Size

      952KB

    • MD5

      4eb66655d6e37627142a92e18ce05556

    • SHA1

      7b92b310488de86f04dd73a057311cebdb6eb2bb

    • SHA256

      fbda851c43f7038c9670ec6b3ed27a034c75c3a4ef5e7cc4e8d49d3bea135e4b

    • SHA512

      27dfcf1eba49b83d9ac0c587523253266a87006b1d793e85225cc5d4efba715e3c2c87171402797b66104db53bc732f7c015560fe9860d7e62e7358bf42ec1db

    • SSDEEP

      12288:Y0XCGPSX0zbyD+ndg+QCImGYUl9qyzlkE2kUNCPUBO/It26+Zqpxg0Z47dG1lFlo:CwE4MROxnFdCIrrcI0AilFEvxHjIQ4

    • Orcus

      Orcus is a Remote Access Trojan that is being sold on underground forums.

    • Orcus main payload

    • Orcurs Rat Executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

MITRE ATT&CK Enterprise v15

Tasks