orcus | c597474f74690ff3a4bf0677dadeff9f5fd5556bc4a208bb142f3b44fefde830 | Triage

Sharing

General

Target

c597474f74690ff3a4bf0677dadeff9f5fd5556bc4a208bb142f3b44fefde830
Size

4.2MB
Sample

240528-b7nplsbd77
MD5

423485438f9d865daf8e39b2c9cc993b
SHA1

1cab541dfe2f647a4bd28b4e2e12d3917cd23d6d
SHA256

c597474f74690ff3a4bf0677dadeff9f5fd5556bc4a208bb142f3b44fefde830
SHA512

f43d7452c01259cb790fc780f95b54642cb466c93e79565539340b7d9544017ecea11c5262366bad814895742258b0052fe17148d7498c0693cc6887974630fc
SSDEEP

98304:3pX2LQT116ToppwMgVypSb2TgTUKo9JCm:h2A13ppwMgVypSQJC

Score

10^/10

orcus новый тег microsoft phishing

Malware Config

Extracted

Family

orcus

Botnet

Новый тег

C2

128.59.46.185:50272

Mutex

sudo_8n66s76c74wp4crfxxfqmi3ojox2jc7q

Attributes

autostart_method
Disable
enable_keylogger
false
install_path
%appdata%\universaleternal\vmuniversal.exe
reconnect_delay
10000
registry_keyname
Sudik
taskscheduler_taskname
sudik
watchdog_path
AppData\aga.exe

Targets

- Target
  
  c597474f74690ff3a4bf0677dadeff9f5fd5556bc4a208bb142f3b44fefde830
- Size
  
  4.2MB
- MD5
  
  423485438f9d865daf8e39b2c9cc993b
- SHA1
  
  1cab541dfe2f647a4bd28b4e2e12d3917cd23d6d
- SHA256
  
  c597474f74690ff3a4bf0677dadeff9f5fd5556bc4a208bb142f3b44fefde830
- SHA512
  
  f43d7452c01259cb790fc780f95b54642cb466c93e79565539340b7d9544017ecea11c5262366bad814895742258b0052fe17148d7498c0693cc6887974630fc
- SSDEEP
  
  98304:3pX2LQT116ToppwMgVypSb2TgTUKo9JCm:h2A13ppwMgVypSQJC
Score

5^/10

microsoft phishing
- Detected potential entity reuse from brand microsoft.
  phishing microsoft
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

новый тегorcus

behavioral1

behavioral2

microsoftphishing