General
-
Target
qqwer.exe
-
Size
918KB
-
Sample
240424-wqa3eaef42
-
MD5
7d129d060cc3a129bb53e892a1577a3e
-
SHA1
6539711680b27db765feba3ff3447a2827ff5ceb
-
SHA256
58224abe87fc5fe738fa3f6e4c05c9912486f2a2d94dc6a02c5ad943350c5f44
-
SHA512
dbfd992ccc71e8de1e26d7d18d78220a10295bbcde2c49db7c965ca32c79dacac1fb728d43846c861c2c8d5324c1f3f0cc17027414a63532cce81086b3ed7525
-
SSDEEP
12288:x0XCGPSX0zbyD+ndg+QCImGYUl9qyzlkE2kUNCh/2Nr6BmYeTpU5c0u7dG1lFlWa:crR4MROxnFiurrcI0AilFEvxHj5Qy
Behavioral task
behavioral1
Sample
qqwer.exe
Resource
win10v2004-20240412-en
Malware Config
Extracted
orcus
s7vety-47274.portmap.host:47274
2dfc3c3857c0466484c2056fcb13e0c9
-
autostart_method
Registry
-
enable_keylogger
false
-
install_path
%temp%\Windows Updater\updateclient.exe
-
reconnect_delay
10000
-
registry_keyname
WindowsUpdater
-
taskscheduler_taskname
Orcus
-
watchdog_path
AppData\OrcusWatchdog.exe
Targets
-
-
Target
qqwer.exe
-
Size
918KB
-
MD5
7d129d060cc3a129bb53e892a1577a3e
-
SHA1
6539711680b27db765feba3ff3447a2827ff5ceb
-
SHA256
58224abe87fc5fe738fa3f6e4c05c9912486f2a2d94dc6a02c5ad943350c5f44
-
SHA512
dbfd992ccc71e8de1e26d7d18d78220a10295bbcde2c49db7c965ca32c79dacac1fb728d43846c861c2c8d5324c1f3f0cc17027414a63532cce81086b3ed7525
-
SSDEEP
12288:x0XCGPSX0zbyD+ndg+QCImGYUl9qyzlkE2kUNCh/2Nr6BmYeTpU5c0u7dG1lFlWa:crR4MROxnFiurrcI0AilFEvxHj5Qy
Score10/10-
Orcus main payload
-
Orcurs Rat Executable
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Adds Run key to start application
-
Drops file in System32 directory
-