Overview

overview

10

Static

static

10

4544-54-0x...ry.exe

windows7-x64

10

4544-54-0x...ry.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    4544-54-0x00000229B7FD0000-0x00000229B82CA000-memory.dmp

  • Size

    3.0MB

  • Sample

    240424-3fhg3abe75

  • MD5

    4b6a8f4d785c2a837492f70058002eec

  • SHA1

    c71148bbc9059978dc2f43ac88ccb4c5861d9bcf

  • SHA256

    dc813bd736ccca8fff66ba9bf8c94fd7fe1dac05d59145cec4b9af18776b02e7

  • SHA512

    83080bb8b6d0ef2116d4615dc035ffdcaa422738d97616191e4e89304ce1806918168adb5ba82a42cae6aef390697c0e507f582c4ba1bb2cfa5859f12d60e431

  • SSDEEP

    49152:HwrPFZKMgSyRfz9W7GpAHyBmFd8mAypQxb0GJo9JnCm9Qrz3I0AilFCvxHu:Hwr65zW7vihypSb0oo9JCm

Score
10/10
orcuscrypt_2ratspywarestealer

Malware Config

Extracted

Family

orcus

Botnet

crypt_2

C2

147.78.103.228:10134

Mutex

3300423d18a6488285e01afe9bcfb819

Attributes
  • autostart_method

    Disable

  • enable_keylogger

    false

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\OrcusWatchdog.exe

Targets

    • Target

      4544-54-0x00000229B7FD0000-0x00000229B82CA000-memory.dmp

    • Size

      3.0MB

    • MD5

      4b6a8f4d785c2a837492f70058002eec

    • SHA1

      c71148bbc9059978dc2f43ac88ccb4c5861d9bcf

    • SHA256

      dc813bd736ccca8fff66ba9bf8c94fd7fe1dac05d59145cec4b9af18776b02e7

    • SHA512

      83080bb8b6d0ef2116d4615dc035ffdcaa422738d97616191e4e89304ce1806918168adb5ba82a42cae6aef390697c0e507f582c4ba1bb2cfa5859f12d60e431

    • SSDEEP

      49152:HwrPFZKMgSyRfz9W7GpAHyBmFd8mAypQxb0GJo9JnCm9Qrz3I0AilFCvxHu:Hwr65zW7vihypSb0oo9JCm

    Score
    10/10
    orcuscrypt_2ratspywarestealer

    • Orcus

      Orcus is a Remote Access Trojan that is being sold on underground forums.

      ratspywarestealerorcus

    • Orcurs Rat Executable

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks