General

  • Target

    0062b1df312506c7bb442c11f3a5bba661c1e058605fae3f2810212c6e63dd1f

  • Size

    948KB

  • Sample

    240129-bc2b8aeeh4

  • MD5

    9b4f45647c0dc17d70ece071bc25b582

  • SHA1

    b32d48db14d4ce8214d684d4d579f01f813f4a13

  • SHA256

    0062b1df312506c7bb442c11f3a5bba661c1e058605fae3f2810212c6e63dd1f

  • SHA512

    da309e50e69a1db1a497fefef38b07a93385615a6d431834042fabdb6f2613e0c8d58dc38eb63074f37a17736a45ac32563075db70a650a47f6e94d8d17b18d3

  • SSDEEP

    24576:1DN4MROxnFZL3RdFrrcI0AilFEvxHPuooJRj:1uMiTrNrrcI0AilFEvxHPU

Malware Config

Extracted

Family

orcus

C2

192.168.0.103:10134

Attributes
  • autostart_method

    Registry

  • enable_keylogger

    false

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\OrcusWatchdog.exe

Targets

    • Target

      0062b1df312506c7bb442c11f3a5bba661c1e058605fae3f2810212c6e63dd1f

    • Size

      948KB

    • MD5

      9b4f45647c0dc17d70ece071bc25b582

    • SHA1

      b32d48db14d4ce8214d684d4d579f01f813f4a13

    • SHA256

      0062b1df312506c7bb442c11f3a5bba661c1e058605fae3f2810212c6e63dd1f

    • SHA512

      da309e50e69a1db1a497fefef38b07a93385615a6d431834042fabdb6f2613e0c8d58dc38eb63074f37a17736a45ac32563075db70a650a47f6e94d8d17b18d3

    • SSDEEP

      24576:1DN4MROxnFZL3RdFrrcI0AilFEvxHPuooJRj:1uMiTrNrrcI0AilFEvxHPU

    • Orcus

      Orcus is a Remote Access Trojan that is being sold on underground forums.

    • Orcus main payload

    • Orcurs Rat Executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

MITRE ATT&CK Enterprise v15

Tasks