orcus | cd903cec8d4fba98097afc9ceaec6f3075a224576b8c98a2752c462ac702fd92 | Triage

Sharing

General

Target

cd903cec8d4fba98097afc9ceaec6f3075a224576b8c98a2752c462ac702fd92
Size

3.0MB
Sample

240425-c84ynaeb9x
MD5

279d59ff6254ed4e982ea78ba1d3441d
SHA1

6a19d95c7f6fe54a35969d4efd326e95ad36d900
SHA256

cd903cec8d4fba98097afc9ceaec6f3075a224576b8c98a2752c462ac702fd92
SHA512

f8765994500fcd56c59357ded60e2f58d42e748df807ea898f2004af3e7864a741aaf9b49967caff298f00d8c98f3ae80690eeb9d22e892b860c85774f2adbbb
SSDEEP

49152:ehqHMr7PcZ8GZKMPLofT0xwcit1GpIEhs3oGAypQxbY1o9JnCmyYAoFhIX7KlFkh:eMHO7vGEuyt16hFBypSbY1o9JCm

Score

10^/10

orcus debug

Malware Config

Extracted

Family

orcus

Botnet

Debug

C2

127.0.0.1:10134

Mutex

94433e5fecd54eeea6cc9ac279093f12

Attributes

autostart_method
Disable
enable_keylogger
false
install_path
%programfiles%\Orcus\Orcus.exe
reconnect_delay
10000
registry_keyname
Orcus
taskscheduler_taskname
Orcus
watchdog_path
AppData\OrcusWatchdog.exe

Targets

- Target
  
  cd903cec8d4fba98097afc9ceaec6f3075a224576b8c98a2752c462ac702fd92
- Size
  
  3.0MB
- MD5
  
  279d59ff6254ed4e982ea78ba1d3441d
- SHA1
  
  6a19d95c7f6fe54a35969d4efd326e95ad36d900
- SHA256
  
  cd903cec8d4fba98097afc9ceaec6f3075a224576b8c98a2752c462ac702fd92
- SHA512
  
  f8765994500fcd56c59357ded60e2f58d42e748df807ea898f2004af3e7864a741aaf9b49967caff298f00d8c98f3ae80690eeb9d22e892b860c85774f2adbbb
- SSDEEP
  
  49152:ehqHMr7PcZ8GZKMPLofT0xwcit1GpIEhs3oGAypQxbY1o9JnCmyYAoFhIX7KlFkh:eMHO7vGEuyt16hFBypSbY1o9JCm
Score

6^/10
- Drops desktop.ini file(s)
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2