Analysis
-
max time kernel
117s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
-
submitted
17-07-2024 01:05
General
-
Target
e28e0b202b118fc3c98e7887eff1f65214d1d4c51dad6b7db86d09913b493477.exe
-
Size
918KB
-
MD5
5474ceea6b0979ae2b41e0ce1ced76f2
-
SHA1
e054f4a3f77f6c65a931489c6c3245ee65f9afab
-
SHA256
e28e0b202b118fc3c98e7887eff1f65214d1d4c51dad6b7db86d09913b493477
-
SHA512
7bae6b92178ccbe72c705ccebc8be74bf0bb2c788e1b99cefe0d0d8fd9c30a0e9de5e9b7a99754192ce3111234eca4787332994661463d85df9f9be958411230
-
SSDEEP
24576:1G+4MROxnFH3iRM4lrrcI0AilFEvxHPeooM:1WMihillrrcI0AilFEvxHP
Score
10/10
Malware Config
Extracted
Family
orcus
C2
147.185.221.21:18264
Mutex
9ba7e84f7b7f4dda90da4044a35cb212
Attributes
-
autostart_method
TaskScheduler
-
enable_keylogger
true
-
install_path
%programfiles%\Windows Fonts\FontDriver.exe
-
reconnect_delay
10000
-
registry_keyname
FontDriver
-
taskscheduler_taskname
WindowsFontDriver
-
watchdog_path
AppData\lssas.exe
Signatures
-
Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
-
Orcurs Rat Executable 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e28e0b202b118fc3c98e7887eff1f65214d1d4c51dad6b7db86d09913b493477.exe"C:\Users\Admin\AppData\Local\Temp\e28e0b202b118fc3c98e7887eff1f65214d1d4c51dad6b7db86d09913b493477.exe"1⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
944KB
-
Filesize
56KB
-
Filesize
368KB
-
Filesize
6.9MB
-
Filesize
72KB
-
Filesize
32KB
-
Filesize
4KB
-
Filesize
6.9MB