General

  • Target

    f77ca4614ab57d07fc2d57c26b444902488626cfa8470063a700076cfa263fdc

  • Size

    927KB

  • Sample

    240212-bmt1wsgb38

  • MD5

    18a2e491f9b2f62a7e053f14015c37db

  • SHA1

    4c75a5359ddbefbfb8266e3f2b9efe0767984a5c

  • SHA256

    f77ca4614ab57d07fc2d57c26b444902488626cfa8470063a700076cfa263fdc

  • SHA512

    9b82163a588810f5f643c00e0eb0b01d58419316a096b203dd7ea29e6bf5d9b4a438aa05fd6b3f86e4155c247f8a1aa90fe124f9acffb07e14e44e018ee4fd1a

  • SSDEEP

    24576:hBB4MROxnFl3jigrrcI0AilFEvxHPRood:hQMirOgrrcI0AilFEvxHP

Malware Config

Extracted

Family

orcus

C2

58.172.73.190:10134

Mutex

6a98ca3fe8a840bfbae0bc6ace9ff251

Attributes
  • autostart_method

    Disable

  • enable_keylogger

    true

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\OrcusWatchdog.exe

Targets

    • Target

      f77ca4614ab57d07fc2d57c26b444902488626cfa8470063a700076cfa263fdc

    • Size

      927KB

    • MD5

      18a2e491f9b2f62a7e053f14015c37db

    • SHA1

      4c75a5359ddbefbfb8266e3f2b9efe0767984a5c

    • SHA256

      f77ca4614ab57d07fc2d57c26b444902488626cfa8470063a700076cfa263fdc

    • SHA512

      9b82163a588810f5f643c00e0eb0b01d58419316a096b203dd7ea29e6bf5d9b4a438aa05fd6b3f86e4155c247f8a1aa90fe124f9acffb07e14e44e018ee4fd1a

    • SSDEEP

      24576:hBB4MROxnFl3jigrrcI0AilFEvxHPRood:hQMirOgrrcI0AilFEvxHP

    • Orcus

      Orcus is a Remote Access Trojan that is being sold on underground forums.

    • Orcus main payload

    • Orcurs Rat Executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks