General
-
Target
c6c8e254eb1ea95974fcb287fa827f267f3baabc78eea9c762b39ee1e4062c21
-
Size
2.6MB
-
Sample
240407-bm2ezagh4z
-
MD5
93e89c47d8f03d1210ec8a59e5c5f369
-
SHA1
f68ad6f15001fe8a7d3af8b8298192a0d054a5f5
-
SHA256
c6c8e254eb1ea95974fcb287fa827f267f3baabc78eea9c762b39ee1e4062c21
-
SHA512
6a1009cec6dad3bbdf001412fd953bf769f33b7fa818013db1172e7daf2b96a5072d2cb0ea840e516ca09b7f6b2d38162dc763ca050fad9749c8d035cdf47749
-
SSDEEP
24576:QAHnh+eWsN3skA4RV1Hom2KXSmHdqf0K44JzixdvW80EXLq31gEfUvWDyBFZpxxY:Hh+ZkldoPKiYdqd6g
Static task
static1
Behavioral task
behavioral1
Sample
c6c8e254eb1ea95974fcb287fa827f267f3baabc78eea9c762b39ee1e4062c21.exe
Resource
win7-20240319-en
Malware Config
Extracted
orcus
ligeon
ligeon.ddns.net:1606
b98fb09a59c24a81b9d17a55ccf2c036
-
autostart_method
Disable
-
enable_keylogger
true
-
install_path
%programfiles%\Orcus\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
Orcus
-
watchdog_path
AppData\OrcusWatchdog.exe
Targets
-
-
Target
c6c8e254eb1ea95974fcb287fa827f267f3baabc78eea9c762b39ee1e4062c21
-
Size
2.6MB
-
MD5
93e89c47d8f03d1210ec8a59e5c5f369
-
SHA1
f68ad6f15001fe8a7d3af8b8298192a0d054a5f5
-
SHA256
c6c8e254eb1ea95974fcb287fa827f267f3baabc78eea9c762b39ee1e4062c21
-
SHA512
6a1009cec6dad3bbdf001412fd953bf769f33b7fa818013db1172e7daf2b96a5072d2cb0ea840e516ca09b7f6b2d38162dc763ca050fad9749c8d035cdf47749
-
SSDEEP
24576:QAHnh+eWsN3skA4RV1Hom2KXSmHdqf0K44JzixdvW80EXLq31gEfUvWDyBFZpxxY:Hh+ZkldoPKiYdqd6g
-
Orcurs Rat Executable
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Suspicious use of SetThreadContext
-