Overview

overview

10

Static

static

1

0374a5265d...b0.exe

windows10-2004-x64

10

Resubmissions

20-05-2024 14:16

240520-rlhjgaeb8t 10

24-03-2024 10:31

240324-mkc55sbh87 7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0374a5265d5ec5febcd31867d36fc3b0.exe

  • Size

    993KB

  • Sample

    240520-rlhjgaeb8t

  • MD5

    0374a5265d5ec5febcd31867d36fc3b0

  • SHA1

    7a0ddd9ea155a4bc7decf202fba4f3ab00945308

  • SHA256

    8dea2d324a4bf1fb49bd5eaf009fdafaa4001807912efff03f411082e01d24b7

  • SHA512

    408b9ac6251c9bdc6b4061e99c3e05e77e06334a283be3958e7c98053133f9c0a69fb08372f5c739ab3879d5539b022d15da30f99e1adbae451c9574200e6b86

  • SSDEEP

    24576:He3veFbXAD9zWi4MxO6m6b/fYLGACf9Dtc2Py/+:He/etqzXOu1Ff9DtTyW

Score
10/10
orcusratspywarestealer

Malware Config

Extracted

Family

orcus

C2

45.157.69.156:443

Mutex

3b453ed253424c82a94898f42bb6a1be

Attributes
  • autostart_method

    Disable

  • enable_keylogger

    false

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\OrcusWatchdog.exe

Targets

    • Target

      0374a5265d5ec5febcd31867d36fc3b0.exe

    • Size

      993KB

    • MD5

      0374a5265d5ec5febcd31867d36fc3b0

    • SHA1

      7a0ddd9ea155a4bc7decf202fba4f3ab00945308

    • SHA256

      8dea2d324a4bf1fb49bd5eaf009fdafaa4001807912efff03f411082e01d24b7

    • SHA512

      408b9ac6251c9bdc6b4061e99c3e05e77e06334a283be3958e7c98053133f9c0a69fb08372f5c739ab3879d5539b022d15da30f99e1adbae451c9574200e6b86

    • SSDEEP

      24576:He3veFbXAD9zWi4MxO6m6b/fYLGACf9Dtc2Py/+:He/etqzXOu1Ff9DtTyW

    Score
    10/10
    orcusratspywarestealer

    • Orcus

      Orcus is a Remote Access Trojan that is being sold on underground forums.

      ratspywarestealerorcus

    • Orcurs Rat Executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks