General
-
Target
d767fb1883ab76477f19093f949a616a58a7198cb5e645aa298d3aa476ab8759
-
Size
3.0MB
-
Sample
240130-bdke4afhbp
-
MD5
9289f359b6b24e2df4944864bd8c9493
-
SHA1
b88cfefb4781d9d6cbea964a57d92c3daf2c37b7
-
SHA256
d767fb1883ab76477f19093f949a616a58a7198cb5e645aa298d3aa476ab8759
-
SHA512
78436eee01b82b7a4fcb2c429288d396ce20a9c0c683e63c78e2f468ae081f939be540706ecb0d9b70cdb5304f8473d3159d1ee737514a84f4c2e762d404c4fc
-
SSDEEP
49152:dOLEKO3T5adZKM0sz5otCeEvsDKx+msbfGGW8wlBKJwAypQxbxEo9JnCmmIrZEIv:dOLtODUKTslWp2MpbfGGilIJPypSbxE8
Behavioral task
behavioral1
Sample
d767fb1883ab76477f19093f949a616a58a7198cb5e645aa298d3aa476ab8759.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
d767fb1883ab76477f19093f949a616a58a7198cb5e645aa298d3aa476ab8759.exe
Resource
win10v2004-20231215-en
Malware Config
Extracted
orcus
47.37.131.144:10134
e357bf5d2338446881e6c9d0cafa3272
-
autostart_method
Registry
-
enable_keylogger
true
-
install_path
%programfiles%\Orcus\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
Fantastik
-
taskscheduler_taskname
Fantastik
-
watchdog_path
Temp\Watchdog.exe
Targets
-
-
Target
d767fb1883ab76477f19093f949a616a58a7198cb5e645aa298d3aa476ab8759
-
Size
3.0MB
-
MD5
9289f359b6b24e2df4944864bd8c9493
-
SHA1
b88cfefb4781d9d6cbea964a57d92c3daf2c37b7
-
SHA256
d767fb1883ab76477f19093f949a616a58a7198cb5e645aa298d3aa476ab8759
-
SHA512
78436eee01b82b7a4fcb2c429288d396ce20a9c0c683e63c78e2f468ae081f939be540706ecb0d9b70cdb5304f8473d3159d1ee737514a84f4c2e762d404c4fc
-
SSDEEP
49152:dOLEKO3T5adZKM0sz5otCeEvsDKx+msbfGGW8wlBKJwAypQxbxEo9JnCmmIrZEIv:dOLtODUKTslWp2MpbfGGilIJPypSbxE8
Score10/10-
Orcus main payload
-
Orcurs Rat Executable
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory
-