Overview

overview

10

Static

static

10

11.exe

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    11.exe

  • Size

    3.0MB

  • Sample

    240528-pspj9adf7z

  • MD5

    43c28623704ec7dcb908347eeefba65e

  • SHA1

    96a5529786a22108c20287e5bb8dda5241435d53

  • SHA256

    d8f7ae1fdf4d2ceec1b8eeb8f88c6fbfe48c42ac79deaab79474a647ebed8868

  • SHA512

    362482c3179bf8b5dd8eb255af6d8d3b4233a934d082ea9241fb725f7c6101e28962d7c4749c9af886218d6c25ad3f60557eb759a1d00db079e4439058a24ce5

  • SSDEEP

    49152:APZonuvKFmwLGZeM9/dFQMDjjzKCkElU+fPONM6WAypQxb1o9JnCm2WncFf0I74q:APCFmwLvEeMDjnpHfP56xypSb1o9JCm

Score
10/10
orcuszombie niggerratspywarestealer

Malware Config

Extracted

Family

orcus

Botnet

Zombie Nigger

C2

192.168.100.3:4444

Mutex

954b6020281f40579bd830bb66bf6d92

Attributes
  • autostart_method

    TaskScheduler

  • enable_keylogger

    false

  • install_path

    C:\Windows\System32\System32BootManger\scvhost.exe

  • reconnect_delay

    10000

  • registry_keyname

    update

  • taskscheduler_taskname

    system32

  • watchdog_path

    AppData\OrcusWatchdog.exe

Targets

    • Target

      11.exe

    • Size

      3.0MB

    • MD5

      43c28623704ec7dcb908347eeefba65e

    • SHA1

      96a5529786a22108c20287e5bb8dda5241435d53

    • SHA256

      d8f7ae1fdf4d2ceec1b8eeb8f88c6fbfe48c42ac79deaab79474a647ebed8868

    • SHA512

      362482c3179bf8b5dd8eb255af6d8d3b4233a934d082ea9241fb725f7c6101e28962d7c4749c9af886218d6c25ad3f60557eb759a1d00db079e4439058a24ce5

    • SSDEEP

      49152:APZonuvKFmwLGZeM9/dFQMDjjzKCkElU+fPONM6WAypQxb1o9JnCm2WncFf0I74q:APCFmwLvEeMDjnpHfP56xypSb1o9JCm

    Score
    10/10
    orcuszombie niggerratspywarestealer

    • Orcus

      Orcus is a Remote Access Trojan that is being sold on underground forums.

      ratspywarestealerorcus

    • Orcurs Rat Executable

    • Executes dropped EXE

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks