44caliber

General

Target

f6649b36f8f7cc9680e319e715291358d5ee4ed3eafd739b53ab8fed3fee5126
Size

2.9MB
Sample

240212-bdakwsea5y
MD5

795cad191a335ac30addd0c963bd6517
SHA1

c1c36d77734f105b62bcb662c4ee5bfe68377e33
SHA256

f6649b36f8f7cc9680e319e715291358d5ee4ed3eafd739b53ab8fed3fee5126
SHA512

a3ae9f8035c366cd5c8dc3d765447517d88245e189844d5eb25e1a2e75af5638ada69f2e313594224bdc8f970b9288e9912c22c1067bd044154509a9b8ca6bb8
SSDEEP

49152:Dyu3MbyTrWLL98QIhidAWs1885v01ashxTFUkXZZifVYDkEmCq+XOue/suKiFGjr:DNMGTtgdA/8hXzZQfVYQE8+J0KiAS8

Score

10^/10

Malware Config

Extracted

Family

orcus

C2

192.168.0.200:10134

Mutex

afa5401f54984aaa863b79961927d3dd

Attributes

autostart_method
TaskScheduler
enable_keylogger
false
install_path
%programfiles%\Orcus\Orcus.exe
reconnect_delay
10000
registry_keyname
Orcus
taskscheduler_taskname
GitHub
watchdog_path
Temp\nurik.exe

Targets

- Target
  
  f6649b36f8f7cc9680e319e715291358d5ee4ed3eafd739b53ab8fed3fee5126
- Size
  
  2.9MB
- MD5
  
  795cad191a335ac30addd0c963bd6517
- SHA1
  
  c1c36d77734f105b62bcb662c4ee5bfe68377e33
- SHA256
  
  f6649b36f8f7cc9680e319e715291358d5ee4ed3eafd739b53ab8fed3fee5126
- SHA512
  
  a3ae9f8035c366cd5c8dc3d765447517d88245e189844d5eb25e1a2e75af5638ada69f2e313594224bdc8f970b9288e9912c22c1067bd044154509a9b8ca6bb8
- SSDEEP
  
  49152:Dyu3MbyTrWLL98QIhidAWs1885v01ashxTFUkXZZifVYDkEmCq+XOue/suKiFGjr:DNMGTtgdA/8hXzZQfVYQE8+J0KiAS8
Score

10^/10

44caliber orcus xmrig miner rat spyware stealer
- 44Caliber
  An open source infostealer written in C#.
  stealer 44caliber
- Orcus
  Orcus is a Remote Access Trojan that is being sold on underground forums.
  rat spyware stealer orcus
- Orcus main payload
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- Orcurs Rat Executable
- XMRig Miner payload
  miner
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Drops desktop.ini file(s)
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2