General

  • Target

    94ff1866a2b3be917a7834ec31764ce52c66215e5e41314d9c065ac17195cdc7

  • Size

    924KB

  • Sample

    240209-bp95wsdf9z

  • MD5

    9e39d932188ef3394c632fa5043b6f3e

  • SHA1

    a8a82cc7d3f71eb870099a9bc941fc0ff6c15d60

  • SHA256

    94ff1866a2b3be917a7834ec31764ce52c66215e5e41314d9c065ac17195cdc7

  • SHA512

    914327b4fca725a32e5c35201aaa44bf702921200fcb3fd4337c2d37be333d5ea7f46dcf864558ab41e494f5e1e99a4ea9839834712081159e92f2b293cde5d2

  • SSDEEP

    24576:8CC4MROxnFE3bO3rrrcI0AilFEvxHPjKJoow:8KMiuorrrcI0AilFEvxHP

Malware Config

Extracted

Family

orcus

Botnet

Hac4ek

C2

192.168.0.109:8848

Mutex

495a1c293fa649038e846af6fd188362

Attributes
  • autostart_method

    TaskScheduler

  • enable_keylogger

    true

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    explorer

  • watchdog_path

    AppData\OrcusWatchdog.exe

Targets

    • Target

      94ff1866a2b3be917a7834ec31764ce52c66215e5e41314d9c065ac17195cdc7

    • Size

      924KB

    • MD5

      9e39d932188ef3394c632fa5043b6f3e

    • SHA1

      a8a82cc7d3f71eb870099a9bc941fc0ff6c15d60

    • SHA256

      94ff1866a2b3be917a7834ec31764ce52c66215e5e41314d9c065ac17195cdc7

    • SHA512

      914327b4fca725a32e5c35201aaa44bf702921200fcb3fd4337c2d37be333d5ea7f46dcf864558ab41e494f5e1e99a4ea9839834712081159e92f2b293cde5d2

    • SSDEEP

      24576:8CC4MROxnFE3bO3rrrcI0AilFEvxHPjKJoow:8KMiuorrrcI0AilFEvxHP

    • Orcus

      Orcus is a Remote Access Trojan that is being sold on underground forums.

    • Orcus main payload

    • Orcurs Rat Executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks