Overview

overview

10

Static

static

3

Extreme In...v3.exe

windows10-2004-x64

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Extreme Injector v3.exe

  • Size

    1.9MB

  • Sample

    240423-zay13sbe51

  • MD5

    8a85b1dbf679febd30fe2f55a811de58

  • SHA1

    d06b7f96415b1ff21adff49ecd84b7b06f01fe6e

  • SHA256

    cfe2e6d9739a3251ed06594563f1d66e9dd018b3c74a96ca3734cca7880fb105

  • SHA512

    9b9ba49b1bc4ef056ade2146ad915eeba819485d49dd2825b4f914b68ec572304c8138f1c202508f40a0e8db8c6443270da333e323d631b27897edf915fefabf

  • SSDEEP

    49152:d4FdetMVCK1LVXXQezP3+Wgm18VeWo/Wz3XEVM:udkCCK3XXQO18VeWJLE

Score
10/10
orcuspersistenceratspywarestealer

Malware Config

Extracted

Family

orcus

C2

s7vety-47274.portmap.host:47274

Mutex

2dfc3c3857c0466484c2056fcb13e0c9

Attributes
  • autostart_method

    Registry

  • enable_keylogger

    false

  • install_path

    %temp%\Windows Updater\updateclient.exe

  • reconnect_delay

    10000

  • registry_keyname

    WindowsUpdater

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\OrcusWatchdog.exe

Targets

    • Target

      Extreme Injector v3.exe

    • Size

      1.9MB

    • MD5

      8a85b1dbf679febd30fe2f55a811de58

    • SHA1

      d06b7f96415b1ff21adff49ecd84b7b06f01fe6e

    • SHA256

      cfe2e6d9739a3251ed06594563f1d66e9dd018b3c74a96ca3734cca7880fb105

    • SHA512

      9b9ba49b1bc4ef056ade2146ad915eeba819485d49dd2825b4f914b68ec572304c8138f1c202508f40a0e8db8c6443270da333e323d631b27897edf915fefabf

    • SSDEEP

      49152:d4FdetMVCK1LVXXQezP3+Wgm18VeWo/Wz3XEVM:udkCCK3XXQO18VeWJLE

    Score
    10/10
    orcuspersistenceratspywarestealer

    • Orcus

      Orcus is a Remote Access Trojan that is being sold on underground forums.

      ratspywarestealerorcus

    • Orcus main payload

    • Orcurs Rat Executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Legitimate hosting services abused for malware hosting/C2

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

3
T1012

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Resource Development

Reconnaissance

Tasks