General

  • Target

    5eced4568a9d921814cf18dd750d87ea7c1074fe52b4262afbd7fee20315751f

  • Size

    2.6MB

  • Sample

    240407-bk7tzagg51

  • MD5

    14661dcdfb063b983503aff30c7e6e9f

  • SHA1

    5ab17bcfe71c34e32f685aed7db9ccecbe6a2f4c

  • SHA256

    5eced4568a9d921814cf18dd750d87ea7c1074fe52b4262afbd7fee20315751f

  • SHA512

    0312faa27feaadf54a1d73f0c15f8eaaaf41f9b95c71701025e89bd7493334c915525349eff836c6f7e18746c97162018079949ceecdd5bd293d9c617e9756ad

  • SSDEEP

    24576:QAHnh+eWsN3skA4RV1Hom2KXSmHdqf0K44JzixdvW80EXLq31gEfUvWDyBFZpxxB:Hh+ZkldoPKiYdqd6p

Malware Config

Extracted

Family

orcus

Botnet

ligeon

C2

ligeon.ddns.net:1606

Mutex

b98fb09a59c24a81b9d17a55ccf2c036

Attributes
  • autostart_method

    Disable

  • enable_keylogger

    true

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\OrcusWatchdog.exe

Targets

    • Target

      5eced4568a9d921814cf18dd750d87ea7c1074fe52b4262afbd7fee20315751f

    • Size

      2.6MB

    • MD5

      14661dcdfb063b983503aff30c7e6e9f

    • SHA1

      5ab17bcfe71c34e32f685aed7db9ccecbe6a2f4c

    • SHA256

      5eced4568a9d921814cf18dd750d87ea7c1074fe52b4262afbd7fee20315751f

    • SHA512

      0312faa27feaadf54a1d73f0c15f8eaaaf41f9b95c71701025e89bd7493334c915525349eff836c6f7e18746c97162018079949ceecdd5bd293d9c617e9756ad

    • SSDEEP

      24576:QAHnh+eWsN3skA4RV1Hom2KXSmHdqf0K44JzixdvW80EXLq31gEfUvWDyBFZpxxB:Hh+ZkldoPKiYdqd6p

    • Orcus

      Orcus is a Remote Access Trojan that is being sold on underground forums.

    • Orcurs Rat Executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

MITRE ATT&CK Enterprise v15

Tasks