Overview

overview

10

Static

static

5

e15c47aa11...0b.exe

windows7-x64

10

e15c47aa11...0b.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    e15c47aa11dec9ee72523d881921a87071e3bb88855a4e23d879bdb7f8c26d0b

  • Size

    2.6MB

  • Sample

    240406-bhsx2agf96

  • MD5

    c61bac1c96ae2872feae1bee9a42ec9e

  • SHA1

    c779bf3cbb4b90ec04c1a13974216ff0fd87c19d

  • SHA256

    e15c47aa11dec9ee72523d881921a87071e3bb88855a4e23d879bdb7f8c26d0b

  • SHA512

    a73ef97d66a4cd44e7342d842d9f0858d4c13f396a9ab63d372f742fd2104f5662e6f29c08f5bbf99219aa332a280ac0f8406b1488f76b5e4621ee14ce6873b2

  • SSDEEP

    24576:QAHnh+eWsN3skA4RV1Hom2KXSmHdqf0K44JzixdvW80EXLq31gEfUvWDyBFZpxxF:Hh+ZkldoPKiYdqd69

Score
10/10
orcusligeonratspywarestealer

Malware Config

Extracted

Family

orcus

Botnet

ligeon

C2

ligeon.ddns.net:1606

Mutex

b98fb09a59c24a81b9d17a55ccf2c036

Attributes
  • autostart_method

    Disable

  • enable_keylogger

    true

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\OrcusWatchdog.exe

Targets

    • Target

      e15c47aa11dec9ee72523d881921a87071e3bb88855a4e23d879bdb7f8c26d0b

    • Size

      2.6MB

    • MD5

      c61bac1c96ae2872feae1bee9a42ec9e

    • SHA1

      c779bf3cbb4b90ec04c1a13974216ff0fd87c19d

    • SHA256

      e15c47aa11dec9ee72523d881921a87071e3bb88855a4e23d879bdb7f8c26d0b

    • SHA512

      a73ef97d66a4cd44e7342d842d9f0858d4c13f396a9ab63d372f742fd2104f5662e6f29c08f5bbf99219aa332a280ac0f8406b1488f76b5e4621ee14ce6873b2

    • SSDEEP

      24576:QAHnh+eWsN3skA4RV1Hom2KXSmHdqf0K44JzixdvW80EXLq31gEfUvWDyBFZpxxF:Hh+ZkldoPKiYdqd69

    Score
    10/10
    orcusligeonratspywarestealer

    • Orcus

      Orcus is a Remote Access Trojan that is being sold on underground forums.

      ratspywarestealerorcus

    • Orcurs Rat Executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks