Overview

overview

10

Static

static

10

9ebfa68448...0e.exe

windows7-x64

10

9ebfa68448...0e.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9ebfa684485369043b5c5c06972a96e592c2b9a4a276361ca0557da90a15f60e

  • Size

    2.0MB

  • Sample

    240520-bgen1scg6y

  • MD5

    cfbef968f6849584b09d80e9400831fb

  • SHA1

    55dcd9883812008506b97913b357086bf83b35f2

  • SHA256

    9ebfa684485369043b5c5c06972a96e592c2b9a4a276361ca0557da90a15f60e

  • SHA512

    f36b932f985a88101c173b33c68653c106dc34deb79653bac29cea8d48afb78570f1627a7259621a5dbaea5a69b4259d18a74f6564aaf5d272e16a9911359836

  • SSDEEP

    12288:55STYf+qnR7Fkxh7dG1lFlWcYT70pxnnaaoawhmg6vgWrOrZNrI0AilFEvxHvBMI:fhg4MROxnFc645rZlI0AilFEvxHi70

Score
10/10
orcusratspywarestealer

Malware Config

Extracted

Family

orcus

C2

185.154.14.217:10134

Mutex

8f9ad032680b48e4921e3dead6b0b2ce

Attributes
  • autostart_method

    TaskScheduler

  • enable_keylogger

    true

  • install_path

    %appdata%\Java\javaUpdate.exe

  • reconnect_delay

    10000

  • registry_keyname

    JavaUpate

  • taskscheduler_taskname

    JavaUpate

  • watchdog_path

    AppData\OrcusWatchdog.exe

Targets

    • Target

      9ebfa684485369043b5c5c06972a96e592c2b9a4a276361ca0557da90a15f60e

    • Size

      2.0MB

    • MD5

      cfbef968f6849584b09d80e9400831fb

    • SHA1

      55dcd9883812008506b97913b357086bf83b35f2

    • SHA256

      9ebfa684485369043b5c5c06972a96e592c2b9a4a276361ca0557da90a15f60e

    • SHA512

      f36b932f985a88101c173b33c68653c106dc34deb79653bac29cea8d48afb78570f1627a7259621a5dbaea5a69b4259d18a74f6564aaf5d272e16a9911359836

    • SSDEEP

      12288:55STYf+qnR7Fkxh7dG1lFlWcYT70pxnnaaoawhmg6vgWrOrZNrI0AilFEvxHvBMI:fhg4MROxnFc645rZlI0AilFEvxHi70

    Score
    10/10
    orcusratspywarestealer

    • Orcus

      Orcus is a Remote Access Trojan that is being sold on underground forums.

      ratspywarestealerorcus

    • Orcus main payload

    • Orcurs Rat Executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Drops desktop.ini file(s)

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks