Overview

overview

10

Static

static

1

1e0ffae5da...3d.exe

windows7-x64

10

1e0ffae5da...3d.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    1e0ffae5da870acc85c8be93b44aee8d07c1fe1811d03d608225aff9816b5d3d.exe

  • Size

    1.0MB

  • Sample

    240725-vhj5nswcre

  • MD5

    3cbe692d9a0c395dabd70e96986d53b5

  • SHA1

    cf495ae9f11d7cbe1cfb8051684fe3c95e9615b8

  • SHA256

    1e0ffae5da870acc85c8be93b44aee8d07c1fe1811d03d608225aff9816b5d3d

  • SHA512

    ef82faa953f3ebff013841954a65b40e726692f0798ca84767e20354e344e40a0ba82723248364aafab91f839200c7bd20863c9e81e1134c43158144420c2485

  • SSDEEP

    24576:/3veFbXAD9zWi4MxO6m6b/fYLGACf9Dtc2PykywO+://etqzXOu1Ff9DtTyM9

Score
10/10
orcusratspywarestealer

Malware Config

Extracted

Family

orcus

C2

45.157.69.156:443

Mutex

3b453ed253424c82a94898f42bb6a1be

Attributes
  • autostart_method

    Disable

  • enable_keylogger

    false

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\OrcusWatchdog.exe

Targets

    • Target

      1e0ffae5da870acc85c8be93b44aee8d07c1fe1811d03d608225aff9816b5d3d.exe

    • Size

      1.0MB

    • MD5

      3cbe692d9a0c395dabd70e96986d53b5

    • SHA1

      cf495ae9f11d7cbe1cfb8051684fe3c95e9615b8

    • SHA256

      1e0ffae5da870acc85c8be93b44aee8d07c1fe1811d03d608225aff9816b5d3d

    • SHA512

      ef82faa953f3ebff013841954a65b40e726692f0798ca84767e20354e344e40a0ba82723248364aafab91f839200c7bd20863c9e81e1134c43158144420c2485

    • SSDEEP

      24576:/3veFbXAD9zWi4MxO6m6b/fYLGACf9Dtc2PykywO+://etqzXOu1Ff9DtTyM9

    Score
    10/10
    orcusratspywarestealer

    • Orcus

      Orcus is a Remote Access Trojan that is being sold on underground forums.

      ratspywarestealerorcus

    • Orcurs Rat Executable

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks