Overview

overview

10

Static

static

5

519e98a8fc...55.exe

windows7-x64

10

519e98a8fc...55.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    519e98a8fc432af6f887b69bdaecc280b82e749104a2ce4644e904c6edc44555

  • Size

    2.6MB

  • Sample

    240423-cpxp8sbf5v

  • MD5

    bd162d72541eb2bd28063891b83e7561

  • SHA1

    81c05100315338a1b06bae7e71fd8f68dccf063e

  • SHA256

    519e98a8fc432af6f887b69bdaecc280b82e749104a2ce4644e904c6edc44555

  • SHA512

    484f6aab5d77d7ff94ee56b85358f8a8a59491d43b7a57f6d0022a6d8c710d7dd4192614865d364e2756d70e9e7ad6a56f01817d32dfea354b7fa4dce51d4d1f

  • SSDEEP

    24576:QAHnh+eWsN3skA4RV1Hom2KXSmHdqf0K44JzixdvW80EXLq31gEfUvWDyBFZpxxy:Hh+ZkldoPKiYdqd66

Score
10/10
orcusligeonratspywarestealer

Malware Config

Extracted

Family

orcus

Botnet

ligeon

C2

ligeon.ddns.net:1606

Mutex

b98fb09a59c24a81b9d17a55ccf2c036

Attributes
  • autostart_method

    Disable

  • enable_keylogger

    true

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\OrcusWatchdog.exe

Targets

    • Target

      519e98a8fc432af6f887b69bdaecc280b82e749104a2ce4644e904c6edc44555

    • Size

      2.6MB

    • MD5

      bd162d72541eb2bd28063891b83e7561

    • SHA1

      81c05100315338a1b06bae7e71fd8f68dccf063e

    • SHA256

      519e98a8fc432af6f887b69bdaecc280b82e749104a2ce4644e904c6edc44555

    • SHA512

      484f6aab5d77d7ff94ee56b85358f8a8a59491d43b7a57f6d0022a6d8c710d7dd4192614865d364e2756d70e9e7ad6a56f01817d32dfea354b7fa4dce51d4d1f

    • SSDEEP

      24576:QAHnh+eWsN3skA4RV1Hom2KXSmHdqf0K44JzixdvW80EXLq31gEfUvWDyBFZpxxy:Hh+ZkldoPKiYdqd66

    Score
    10/10
    orcusligeonratspywarestealer

    • Orcus

      Orcus is a Remote Access Trojan that is being sold on underground forums.

      ratspywarestealerorcus

    • Orcurs Rat Executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • AutoIT Executable

      AutoIT scripts compiled to PE executables.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks