orcus | faa87251336d864b877a5e6c3e9c9a5e250318be2fdfc8a42ceadb3a956e0405 | Triage

Submit
Reports

Overview

overview

Static

static

3

7z2408.exe

windows7-x64

3

7z2408.exe

windows10-2004-x64

Sharing

General

Target

7z2408.exe
Size

1.3MB
Sample

240826-s92spasarb
MD5

d646419d462f0206a3341aef0aa5e3c7
SHA1

eb4b809bbf91804e9bb17be36e9469818601ed91
SHA256

faa87251336d864b877a5e6c3e9c9a5e250318be2fdfc8a42ceadb3a956e0405
SHA512

7f6c46c780fcb5fc10cc5405221179ddecbbb871c578ca3d9e3a74141271b383bd83e8f9d75c98d7e9d406e9b935d52a6b04913d654169e0b30f0719225e7dd9
SSDEEP

24576:0AkPEo1y9fcw5K42KmEDCesqTvbdWZWz08ZuEzamDoyhbxGC7eBRak0a7IU9F0:0AJoo24xVWerHkZWAbFWoyhiakn7IU9S

Score

10^/10

orcus credential_access discovery rat spyware stealer

Static task

static1

1 signatures

Behavioral task

behavioral1

Sample

7z2408.exe

Resource

win7-20240704-en

windows7-x64

2 signatures

1800 seconds

Behavioral task

behavioral2

Sample

7z2408.exe

Resource

win10v2004-20240802-en

orcus credential_access discovery rat spyware stealer

windows10-2004-x64

23 signatures

1800 seconds

Malware Config

Targets

- Target
  
  7z2408.exe
- Size
  
  1.3MB
- MD5
  
  d646419d462f0206a3341aef0aa5e3c7
- SHA1
  
  eb4b809bbf91804e9bb17be36e9469818601ed91
- SHA256
  
  faa87251336d864b877a5e6c3e9c9a5e250318be2fdfc8a42ceadb3a956e0405
- SHA512
  
  7f6c46c780fcb5fc10cc5405221179ddecbbb871c578ca3d9e3a74141271b383bd83e8f9d75c98d7e9d406e9b935d52a6b04913d654169e0b30f0719225e7dd9
- SSDEEP
  
  24576:0AkPEo1y9fcw5K42KmEDCesqTvbdWZWz08ZuEzamDoyhbxGC7eBRak0a7IU9F0:0AJoo24xVWerHkZWAbFWoyhiakn7IU9S
Score

10^/10

discovery orcus credential_access rat spyware stealer
- Orcus
  Orcus is a Remote Access Trojan that is being sold on underground forums.
  rat spyware stealer orcus
- Credentials from Password Stores: Credentials from Web Browsers
  Malicious Access or copy of Web Browser Credential store.
  credential_access stealer
- Orcurs Rat Executable
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

Credential Access

Credentials from Password Stores

Credentials from Web Browsers

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

System Location Discovery

System Language Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

static1

behavioral1

behavioral2

orcuscredential_accessdiscoveryratspywarestealer

© 2018-2025

Terms | Privacy