Extracted

• • Target

    f6649b36f8f7cc9680e319e715291358d5ee4ed3eafd739b53ab8fed3fee5126

  • Size

    2.9MB

  • MD5

    795cad191a335ac30addd0c963bd6517

  • SHA1

    c1c36d77734f105b62bcb662c4ee5bfe68377e33

  • SHA256

    f6649b36f8f7cc9680e319e715291358d5ee4ed3eafd739b53ab8fed3fee5126

  • SHA512

    a3ae9f8035c366cd5c8dc3d765447517d88245e189844d5eb25e1a2e75af5638ada69f2e313594224bdc8f970b9288e9912c22c1067bd044154509a9b8ca6bb8

  • SSDEEP

    49152:Dyu3MbyTrWLL98QIhidAWs1885v01ashxTFUkXZZifVYDkEmCq+XOue/suKiFGjr:DNMGTtgdA/8hXzZQfVYQE8+J0KiAS8

  Score

  10^/10

  44caliberorcusxmrigminerratspywarestealer

  • 44Caliber

    An open source infostealer written in C#.

    stealer44caliber

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcus main payload

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • Orcurs Rat Executable

  • XMRig Miner payload

    miner

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Drops desktop.ini file(s)

  • Legitimate hosting services abused for malware hosting/C2

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2