Overview

overview

10

Static

static

10

a1aceb4721...25.exe

windows7-x64

10

a1aceb4721...25.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    a1aceb472152e5f8a0da2389a13f2db959788d8790c97363dbf742ef966c5b25

  • Size

    910KB

  • Sample

    240729-cpw4psscrd

  • MD5

    8e3f383b02d4c62b543d5b7c56d4db79

  • SHA1

    53888e44275358a395630841a244d16226beb1dc

  • SHA256

    a1aceb472152e5f8a0da2389a13f2db959788d8790c97363dbf742ef966c5b25

  • SHA512

    c113e49c3221fb517d66d827a1f822e4133625535b9e950c08b7cc4adedbcd42297143d511fd8fd69adcd3818c24a631acc01afe9ed0206cc43b87fc5a1406c0

  • SSDEEP

    12288:/0XCGPSX0zbyD+ndg+QCImGYUl9qyzlkE2kUNCg+34ai5V2Xopqi1n07dG1lFlWe:L2C4MROxnFRC8rrcI0AilFEvxHjoQJ

Score
10/10
orcusligeonratspywarestealer

Malware Config

Extracted

Family

orcus

Botnet

ligeon

C2

ligeon.ddns.net:1606

Mutex

b98fb09a59c24a81b9d17a55ccf2c036

Attributes
  • autostart_method

    Disable

  • enable_keylogger

    true

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\OrcusWatchdog.exe

Targets

    • Target

      a1aceb472152e5f8a0da2389a13f2db959788d8790c97363dbf742ef966c5b25

    • Size

      910KB

    • MD5

      8e3f383b02d4c62b543d5b7c56d4db79

    • SHA1

      53888e44275358a395630841a244d16226beb1dc

    • SHA256

      a1aceb472152e5f8a0da2389a13f2db959788d8790c97363dbf742ef966c5b25

    • SHA512

      c113e49c3221fb517d66d827a1f822e4133625535b9e950c08b7cc4adedbcd42297143d511fd8fd69adcd3818c24a631acc01afe9ed0206cc43b87fc5a1406c0

    • SSDEEP

      12288:/0XCGPSX0zbyD+ndg+QCImGYUl9qyzlkE2kUNCg+34ai5V2Xopqi1n07dG1lFlWe:L2C4MROxnFRC8rrcI0AilFEvxHjoQJ

    Score
    10/10
    orcusligeonratspywarestealer

    • Orcus

      Orcus is a Remote Access Trojan that is being sold on underground forums.

      ratspywarestealerorcus

    • Orcurs Rat Executable

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks