General
-
Target
6a12927ee17c36cb572807efc78d8f566f5959fc242dbdf7579b741e88768948
-
Size
3.0MB
-
Sample
240129-brplzaehe7
-
MD5
83dbc0a947aebae0056a8d6ac5743a10
-
SHA1
3cdd967bd1566121f93c3d25eae049077b4fa7c5
-
SHA256
6a12927ee17c36cb572807efc78d8f566f5959fc242dbdf7579b741e88768948
-
SHA512
30c865d06b8a624e0c3897af3e3dfd69947ffeb9d78c7106cffd3548e1878190ceed75354368b9692ccc08a3ffe961246a0c41e2bef868283e7e0ff003d1f1a5
-
SSDEEP
49152:Y1HS7p1EZKMnkmWg8LX5prviYDyKS5AypQxbRQAo9JnCmpbu/nRFfjI7L0qb:YUHTPJg8z1mKnypSbRxo9JCm
Behavioral task
behavioral1
Sample
6a12927ee17c36cb572807efc78d8f566f5959fc242dbdf7579b741e88768948.exe
Resource
win7-20231215-en
Malware Config
Extracted
orcus
Новый тег
31.44.184.52:40772
sudo_3a2nyavrxxk623ejchf6qtuvzrhyxnzz
-
autostart_method
Disable
-
enable_keylogger
false
-
install_path
%appdata%\defaultlocal\vmlinux.exe
-
reconnect_delay
10000
-
registry_keyname
Sudik
-
taskscheduler_taskname
sudik
-
watchdog_path
AppData\aga.exe
Targets
-
-
Target
6a12927ee17c36cb572807efc78d8f566f5959fc242dbdf7579b741e88768948
-
Size
3.0MB
-
MD5
83dbc0a947aebae0056a8d6ac5743a10
-
SHA1
3cdd967bd1566121f93c3d25eae049077b4fa7c5
-
SHA256
6a12927ee17c36cb572807efc78d8f566f5959fc242dbdf7579b741e88768948
-
SHA512
30c865d06b8a624e0c3897af3e3dfd69947ffeb9d78c7106cffd3548e1878190ceed75354368b9692ccc08a3ffe961246a0c41e2bef868283e7e0ff003d1f1a5
-
SSDEEP
49152:Y1HS7p1EZKMnkmWg8LX5prviYDyKS5AypQxbRQAo9JnCmpbu/nRFfjI7L0qb:YUHTPJg8z1mKnypSbRxo9JCm
-
Orcus main payload
-
Orcurs Rat Executable
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-