General
-
Target
file.exe
-
Size
915KB
-
Sample
240204-w25fdsgaf9
-
MD5
eaf21376cebd21a795d8ceaa36117189
-
SHA1
07fe1f4e0f1948f944c1c92213b6c8bd4507615f
-
SHA256
3997cd980cabfc6de9b8e44509a39b419cc3b67da8ea94db6182a4ba124dcf88
-
SHA512
66bd5170027ba16f11d64dc1495ee41c637931cfbde31169564995e670218b66b3773b4c77e41ef4b8b692154aa5d2163f684ecd802be520d77d82a813b3ad48
-
SSDEEP
24576:eIJu4MROxnFD3ErXYf1rrcI0AilFEvxHPhxooF:e6MiJNrrcI0AilFEvxHP
Behavioral task
behavioral1
Sample
file.exe
Resource
win10v2004-20231222-en
Malware Config
Extracted
orcus
obfuscated.us:8080
a944d250f8b74b78867dc02caf0ed0d0
-
autostart_method
Registry
-
enable_keylogger
true
-
install_path
%programfiles%\System32\System32
-
reconnect_delay
10000
-
registry_keyname
Windows
-
taskscheduler_taskname
Orcus
-
watchdog_path
AppData\System32.exe
Targets
-
-
Target
file.exe
-
Size
915KB
-
MD5
eaf21376cebd21a795d8ceaa36117189
-
SHA1
07fe1f4e0f1948f944c1c92213b6c8bd4507615f
-
SHA256
3997cd980cabfc6de9b8e44509a39b419cc3b67da8ea94db6182a4ba124dcf88
-
SHA512
66bd5170027ba16f11d64dc1495ee41c637931cfbde31169564995e670218b66b3773b4c77e41ef4b8b692154aa5d2163f684ecd802be520d77d82a813b3ad48
-
SSDEEP
24576:eIJu4MROxnFD3ErXYf1rrcI0AilFEvxHPhxooF:e6MiJNrrcI0AilFEvxHP
-
Orcus main payload
-
Orcurs Rat Executable
-
Executes dropped EXE
-
Drops file in System32 directory
-