Overview

overview

10

Static

static

5

f6de6b3418...c6.exe

windows7-x64

10

f6de6b3418...c6.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f6de6b3418dbfab58becb7352020d2df510c83ad524056887f5e394ada7d81c6

  • Size

    2.6MB

  • Sample

    240413-bstbjshg25

  • MD5

    7c0730b6c969a44de3efde25ca51391a

  • SHA1

    0265932d08673ad26dd5cc68d248425148cc5544

  • SHA256

    f6de6b3418dbfab58becb7352020d2df510c83ad524056887f5e394ada7d81c6

  • SHA512

    a5cd3d21dff3358dceeefc7d990b264b01168b6b825603aa5f5e552ba6aa7b81bc80ade29bb58b3231427694d2e98afa9265eb0075b7382f8826eaa39c2ea7da

  • SSDEEP

    24576:SAHnh+eWsN3skA4RV1Hom2KXSmHdK3VqbE6przwKpwvEuM/SD0wugdDEl6NrL/N5:Vh+ZkldoPKiYdKr9z

Score
10/10
orcusligeonratspywarestealer

Malware Config

Extracted

Family

orcus

Botnet

ligeon

C2

ligeon.ddns.net:1606

Mutex

b98fb09a59c24a81b9d17a55ccf2c036

Attributes
  • autostart_method

    Disable

  • enable_keylogger

    true

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\OrcusWatchdog.exe

Targets

    • Target

      f6de6b3418dbfab58becb7352020d2df510c83ad524056887f5e394ada7d81c6

    • Size

      2.6MB

    • MD5

      7c0730b6c969a44de3efde25ca51391a

    • SHA1

      0265932d08673ad26dd5cc68d248425148cc5544

    • SHA256

      f6de6b3418dbfab58becb7352020d2df510c83ad524056887f5e394ada7d81c6

    • SHA512

      a5cd3d21dff3358dceeefc7d990b264b01168b6b825603aa5f5e552ba6aa7b81bc80ade29bb58b3231427694d2e98afa9265eb0075b7382f8826eaa39c2ea7da

    • SSDEEP

      24576:SAHnh+eWsN3skA4RV1Hom2KXSmHdK3VqbE6przwKpwvEuM/SD0wugdDEl6NrL/N5:Vh+ZkldoPKiYdKr9z

    Score
    10/10
    orcusligeonratspywarestealer

    • Orcus

      Orcus is a Remote Access Trojan that is being sold on underground forums.

      ratspywarestealerorcus

    • Orcurs Rat Executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Executes dropped EXE

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks