Overview

overview

10

Static

static

10

9fedb52beb...2c.exe

windows7-x64

10

9fedb52beb...2c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9fedb52bebc89b548caf1c2d8438b88e3abe3004106f5c85595fa9ef3b952c2c

  • Size

    3.0MB

  • Sample

    240424-cfvjhsea8y

  • MD5

    c636ea3b6f9877ba652b6eff45951533

  • SHA1

    f0cb217fe930c1f55bdd64633b111785df4816c6

  • SHA256

    9fedb52bebc89b548caf1c2d8438b88e3abe3004106f5c85595fa9ef3b952c2c

  • SHA512

    b40941fb08547aa8492ce1fb98cd9ad0b51d7d527e69101fc92e7c17fa56ddb1a7503bb39eae4b0e79762edafaee1ae14db2ecbe4c5b7e3b38eace8c6674251b

  • SSDEEP

    49152:ZGX87p1EZKMnkmWg8LX5prviYDyKS5AypQxbRQAo9JnCmpKu/nRFfjI7L0qb:ZLHTPJg8z1mKnypSbRxo9JCm

Score
10/10
orcusновый тегratspywarestealer

Malware Config

Extracted

Family

orcus

Botnet

Новый тег

C2

31.44.184.52:64770

Mutex

sudo_acbjyh476x3aev1tpdb5g04kwe8v7vcj

Attributes
  • autostart_method

    Disable

  • enable_keylogger

    false

  • install_path

    C:\Program Files (x86)\Tlauncher.exe

  • reconnect_delay

    10000

  • registry_keyname

    Sudik

  • taskscheduler_taskname

    sudik

  • watchdog_path

    AppData\aga.exe

Targets

    • Target

      9fedb52bebc89b548caf1c2d8438b88e3abe3004106f5c85595fa9ef3b952c2c

    • Size

      3.0MB

    • MD5

      c636ea3b6f9877ba652b6eff45951533

    • SHA1

      f0cb217fe930c1f55bdd64633b111785df4816c6

    • SHA256

      9fedb52bebc89b548caf1c2d8438b88e3abe3004106f5c85595fa9ef3b952c2c

    • SHA512

      b40941fb08547aa8492ce1fb98cd9ad0b51d7d527e69101fc92e7c17fa56ddb1a7503bb39eae4b0e79762edafaee1ae14db2ecbe4c5b7e3b38eace8c6674251b

    • SSDEEP

      49152:ZGX87p1EZKMnkmWg8LX5prviYDyKS5AypQxbRQAo9JnCmpKu/nRFfjI7L0qb:ZLHTPJg8z1mKnypSbRxo9JCm

    Score
    10/10
    orcusновый тегratspywarestealer

    • Orcus

      Orcus is a Remote Access Trojan that is being sold on underground forums.

      ratspywarestealerorcus

    • Orcus main payload

    • Orcurs Rat Executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks