Overview

overview

10

Static

static

10

nursultan crack.exe

windows7-x64

10

nursultan crack.exe

windows10-2004-x64

6

Sharing

Copy URL
Twitter E-mail

General

  • Target

    nursultan crack.exe

  • Size

    917KB

  • Sample

    240627-k9mprstekf

  • MD5

    120802a68926043553500b2521832a7c

  • SHA1

    18b9d5a66d650c6fc5bcf8f4401f0912d209f354

  • SHA256

    490e237dd1557759ef2f1f7ea188ffec35d01199483ba77d027b2b5d654d634d

  • SHA512

    b226c83e8d72292d56cd63f2b2192b80acbc7ba19c9c418f5d168e61886ab971b42abc9f0b9c85611af42ea6601a9d08b2066ca0a8b07a99ed1d1df54a052a85

  • SSDEEP

    24576:aVl64MROxnFi3erxrZlI0AilFEvxHi1kp:aVDMioe1rZlI0AilFEvxHi

Score
10/10
orcusratspywarestealer

Malware Config

Extracted

Family

orcus

C2

192.168.56.1:7846

Mutex

ea591914ecaf493998021ae6da75d71b

Attributes
  • autostart_method

    Disable

  • enable_keylogger

    true

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\pidor.exe

Targets

    • Target

      nursultan crack.exe

    • Size

      917KB

    • MD5

      120802a68926043553500b2521832a7c

    • SHA1

      18b9d5a66d650c6fc5bcf8f4401f0912d209f354

    • SHA256

      490e237dd1557759ef2f1f7ea188ffec35d01199483ba77d027b2b5d654d634d

    • SHA512

      b226c83e8d72292d56cd63f2b2192b80acbc7ba19c9c418f5d168e61886ab971b42abc9f0b9c85611af42ea6601a9d08b2066ca0a8b07a99ed1d1df54a052a85

    • SSDEEP

      24576:aVl64MROxnFi3erxrZlI0AilFEvxHi1kp:aVDMioe1rZlI0AilFEvxHi

    Score
    10/10
    orcusratspywarestealer

    • Orcus

      Orcus is a Remote Access Trojan that is being sold on underground forums.

      ratspywarestealerorcus

    • Orcus main payload

    • Orcurs Rat Executable

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops desktop.ini file(s)

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks