Overview

overview

10

Static

static

5

b5af8b4156...a7.exe

windows7-x64

10

b5af8b4156...a7.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b5af8b415653f7c927c09d93ae038301fa5bd121f455f6efd006c40c56b0f5a7

  • Size

    2.6MB

  • Sample

    240417-cy4j5sbd49

  • MD5

    1d1e084394ccbc02b21db7b58b355c15

  • SHA1

    d94ed25a49b02029b839d75cb95c65c242fc9a1e

  • SHA256

    b5af8b415653f7c927c09d93ae038301fa5bd121f455f6efd006c40c56b0f5a7

  • SHA512

    ab1b2adc4c535fc6d6ec020861005cb6ab98ca555accef3d617d206677464b5e96576919fffb67c06c3972d331a0f7482b4e78b325bf2d388f72ee0b4c035dde

  • SSDEEP

    24576:QAHnh+eWsN3skA4RV1Hom2KXSmHdqf0K44JzixdvW80EXLq31gEfUvWDyBFZpxxj:Hh+ZkldoPKiYdqd6b

Score
10/10
orcusligeonratspywarestealer

Malware Config

Extracted

Family

orcus

Botnet

ligeon

C2

ligeon.ddns.net:1606

Mutex

b98fb09a59c24a81b9d17a55ccf2c036

Attributes
  • autostart_method

    Disable

  • enable_keylogger

    true

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\OrcusWatchdog.exe

Targets

    • Target

      b5af8b415653f7c927c09d93ae038301fa5bd121f455f6efd006c40c56b0f5a7

    • Size

      2.6MB

    • MD5

      1d1e084394ccbc02b21db7b58b355c15

    • SHA1

      d94ed25a49b02029b839d75cb95c65c242fc9a1e

    • SHA256

      b5af8b415653f7c927c09d93ae038301fa5bd121f455f6efd006c40c56b0f5a7

    • SHA512

      ab1b2adc4c535fc6d6ec020861005cb6ab98ca555accef3d617d206677464b5e96576919fffb67c06c3972d331a0f7482b4e78b325bf2d388f72ee0b4c035dde

    • SSDEEP

      24576:QAHnh+eWsN3skA4RV1Hom2KXSmHdqf0K44JzixdvW80EXLq31gEfUvWDyBFZpxxj:Hh+ZkldoPKiYdqd6b

    Score
    10/10
    orcusligeonratspywarestealer

    • Orcus

      Orcus is a Remote Access Trojan that is being sold on underground forums.

      ratspywarestealerorcus

    • Orcurs Rat Executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks