General
-
Target
94ff1866a2b3be917a7834ec31764ce52c66215e5e41314d9c065ac17195cdc7
-
Size
924KB
-
Sample
240209-bp95wsdf9z
-
MD5
9e39d932188ef3394c632fa5043b6f3e
-
SHA1
a8a82cc7d3f71eb870099a9bc941fc0ff6c15d60
-
SHA256
94ff1866a2b3be917a7834ec31764ce52c66215e5e41314d9c065ac17195cdc7
-
SHA512
914327b4fca725a32e5c35201aaa44bf702921200fcb3fd4337c2d37be333d5ea7f46dcf864558ab41e494f5e1e99a4ea9839834712081159e92f2b293cde5d2
-
SSDEEP
24576:8CC4MROxnFE3bO3rrrcI0AilFEvxHPjKJoow:8KMiuorrrcI0AilFEvxHP
Behavioral task
behavioral1
Sample
94ff1866a2b3be917a7834ec31764ce52c66215e5e41314d9c065ac17195cdc7.exe
Resource
win7-20231215-en
Malware Config
Extracted
orcus
Hac4ek
192.168.0.109:8848
495a1c293fa649038e846af6fd188362
-
autostart_method
TaskScheduler
-
enable_keylogger
true
-
install_path
%programfiles%\Orcus\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
explorer
-
watchdog_path
AppData\OrcusWatchdog.exe
Targets
-
-
Target
94ff1866a2b3be917a7834ec31764ce52c66215e5e41314d9c065ac17195cdc7
-
Size
924KB
-
MD5
9e39d932188ef3394c632fa5043b6f3e
-
SHA1
a8a82cc7d3f71eb870099a9bc941fc0ff6c15d60
-
SHA256
94ff1866a2b3be917a7834ec31764ce52c66215e5e41314d9c065ac17195cdc7
-
SHA512
914327b4fca725a32e5c35201aaa44bf702921200fcb3fd4337c2d37be333d5ea7f46dcf864558ab41e494f5e1e99a4ea9839834712081159e92f2b293cde5d2
-
SSDEEP
24576:8CC4MROxnFE3bO3rrrcI0AilFEvxHPjKJoow:8KMiuorrrcI0AilFEvxHP
-
Orcus main payload
-
Orcurs Rat Executable
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Drops file in System32 directory
-