Overview

overview

10

Static

static

10

ez.exe

windows10-1703-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    ez.exe

  • Size

    903KB

  • Sample

    240801-slyfcs1dqc

  • MD5

    360d22ae0477099e74b169afdd835fa3

  • SHA1

    28d0961a0c4681530d1894fab03182af873cc249

  • SHA256

    52d3a605d6d2542fc5bdd50d1e60318fbba19ea0774210de5ea4b7c2724fc581

  • SHA512

    934172a9d987f9c06f134145b414b1e230198bc5a3799b6e3f8bf954ab8b8811c426772135e4399fed8f6c3fe879a329f9353f8f84a6c02e431840308267d7c4

  • SSDEEP

    12288:KTUZ/Y95eo6L4ce7dG1lFlWcYT70pxnnaaoawZRVcTqSA+9rZNrI0AilFEvxHvBc:cqI4MROxnFMLqrZlI0AilFEvxHiLB

Score
10/10
orcusratspywarestealer

Malware Config

Extracted

Family

orcus

C2

188.212.101.97:10134

Mutex

ee94bd16e34c4afb97e0bbe05badecb5

Attributes
  • autostart_method

    Disable

  • enable_keylogger

    false

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\OrcusWatchdog.exe

Targets

    • Target

      ez.exe

    • Size

      903KB

    • MD5

      360d22ae0477099e74b169afdd835fa3

    • SHA1

      28d0961a0c4681530d1894fab03182af873cc249

    • SHA256

      52d3a605d6d2542fc5bdd50d1e60318fbba19ea0774210de5ea4b7c2724fc581

    • SHA512

      934172a9d987f9c06f134145b414b1e230198bc5a3799b6e3f8bf954ab8b8811c426772135e4399fed8f6c3fe879a329f9353f8f84a6c02e431840308267d7c4

    • SSDEEP

      12288:KTUZ/Y95eo6L4ce7dG1lFlWcYT70pxnnaaoawZRVcTqSA+9rZNrI0AilFEvxHvBc:cqI4MROxnFMLqrZlI0AilFEvxHiLB

    Score
    10/10
    orcusratspywarestealer

    • Orcus

      Orcus is a Remote Access Trojan that is being sold on underground forums.

      ratspywarestealerorcus

    • Orcus main payload

    • Orcurs Rat Executable

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops desktop.ini file(s)

    • Enumerates connected drives

      Attempts to read the root path of hard drives other than the default C: drive.

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks