General
-
Target
123123.exe
-
Size
3.0MB
-
Sample
240216-r4alkscf75
-
MD5
139081c644c590056c3fc71a11b93524
-
SHA1
d6cff7c050d00ae5ce30597ecfdb92d90fa93bee
-
SHA256
c53acf171d6d1ac73589e27d3b2ff8271e7828b4d281fd5a3ccfe5449fc1d491
-
SHA512
ea9a3c3a01d3e44bf6897d8a29107a61a07753fe2f614059fd1ca9ab23ca27f748dcbb3fff8b59f65d652488d82cc5acdbbcf542e7f9d6deebf23ce03ded5575
-
SSDEEP
49152:/Jfw6fZeM9/ryj9aB50LFqSsVsFAypQxbqZo9JnCm9EWncFf0I74gu37M:/5mYlf0LFqSsiCypSbQo9JCm
Malware Config
Extracted
orcus
v1
18.ip.gl.ply.gg:24975
14042427fd724b8f96b0e0e3ec6fdc77
-
autostart_method
Registry
-
enable_keylogger
false
-
install_path
%programfiles%\Orcus\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
DllHostSV
-
taskscheduler_taskname
Orcus
-
watchdog_path
AppData\ClientFrameworkWindows
Targets
-
-
Target
123123.exe
-
Size
3.0MB
-
MD5
139081c644c590056c3fc71a11b93524
-
SHA1
d6cff7c050d00ae5ce30597ecfdb92d90fa93bee
-
SHA256
c53acf171d6d1ac73589e27d3b2ff8271e7828b4d281fd5a3ccfe5449fc1d491
-
SHA512
ea9a3c3a01d3e44bf6897d8a29107a61a07753fe2f614059fd1ca9ab23ca27f748dcbb3fff8b59f65d652488d82cc5acdbbcf542e7f9d6deebf23ce03ded5575
-
SSDEEP
49152:/Jfw6fZeM9/ryj9aB50LFqSsVsFAypQxbqZo9JnCm9EWncFf0I74gu37M:/5mYlf0LFqSsiCypSbQo9JCm
-
Orcurs Rat Executable
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory
-