Overview

overview

10

Static

static

1

2cfcbae378...00.exe

windows10-2004-x64

10

Resubmissions

20-05-2024 14:16

240520-rlahvsdd52 10

24-03-2024 22:26

240324-2cg7fscc9t 7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2cfcbae378ab69f0a78671a560571700.exe

  • Size

    2.6MB

  • Sample

    240520-rlahvsdd52

  • MD5

    2cfcbae378ab69f0a78671a560571700

  • SHA1

    97a6e23d367fb58e5076780b9d6358bd7d0ee592

  • SHA256

    17bcbc74ec8166ff11ef983aece5446115a54eddb47138cd6ff7e5a509634962

  • SHA512

    803bef8de5d4693d08611afc9bcc1ec61a159b71bc86cac02ba853c5c335110e161f58c759521eb9c2d7e86d376754d87a2789d91094289e67daf2b4c961c67a

  • SSDEEP

    24576:ke3veFbXAD9zWi4MxO6m6b/fYLGACf9Dtc2PyX8+:ke/etqzXOu1Ff9DtTyf

Score
10/10
orcusratspywarestealer

Malware Config

Extracted

Family

orcus

C2

45.157.69.156:443

Mutex

3b453ed253424c82a94898f42bb6a1be

Attributes
  • autostart_method

    Disable

  • enable_keylogger

    false

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\OrcusWatchdog.exe

Targets

    • Target

      2cfcbae378ab69f0a78671a560571700.exe

    • Size

      2.6MB

    • MD5

      2cfcbae378ab69f0a78671a560571700

    • SHA1

      97a6e23d367fb58e5076780b9d6358bd7d0ee592

    • SHA256

      17bcbc74ec8166ff11ef983aece5446115a54eddb47138cd6ff7e5a509634962

    • SHA512

      803bef8de5d4693d08611afc9bcc1ec61a159b71bc86cac02ba853c5c335110e161f58c759521eb9c2d7e86d376754d87a2789d91094289e67daf2b4c961c67a

    • SSDEEP

      24576:ke3veFbXAD9zWi4MxO6m6b/fYLGACf9Dtc2PyX8+:ke/etqzXOu1Ff9DtTyf

    Score
    10/10
    orcusratspywarestealer

    • Orcus

      Orcus is a Remote Access Trojan that is being sold on underground forums.

      ratspywarestealerorcus

    • Orcurs Rat Executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks