Overview

overview

10

Static

static

10

sweqeqwee1wq.exe

windows7-x64

1

sweqeqwee1wq.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    sweqeqwee1wq.exe

  • Size

    903KB

  • Sample

    240914-faa5gaxflf

  • MD5

    048a2115f9c1a0188b3abb2b4eb17be6

  • SHA1

    419c5db2b16cde817450d18911fdacca6212bc17

  • SHA256

    5aa80ce91ab757f4ee273d76dfe6d36998ffea02b129af854b2ba0bc05e3e889

  • SHA512

    7a9d107cd309a07938048265e69d7109d955310b7fe925906e0b2cb1a0243b678d4d40d2d8753ca0f7547e7f9d8046cc900a6b8bd365540ce1a64a5c5f25d6cd

  • SSDEEP

    12288:88shHAVBuQBBed37dG1lFlWcYT70pxnnaaoawMRVcTqSA+9rZNrI0AilFEvxHvBR:V3s4MROxnF9LqrZlI0AilFEvxHi7o

Score
10/10
orcusratspywarestealer

Malware Config

Extracted

Family

orcus

C2

127.0.0.1:2015

Mutex

b9c4a8fd436449b6abe8bcd530bc0400

Attributes
  • autostart_method

    Disable

  • enable_keylogger

    false

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\OrcusWatchdog.exe

Targets

    • Target

      sweqeqwee1wq.exe

    • Size

      903KB

    • MD5

      048a2115f9c1a0188b3abb2b4eb17be6

    • SHA1

      419c5db2b16cde817450d18911fdacca6212bc17

    • SHA256

      5aa80ce91ab757f4ee273d76dfe6d36998ffea02b129af854b2ba0bc05e3e889

    • SHA512

      7a9d107cd309a07938048265e69d7109d955310b7fe925906e0b2cb1a0243b678d4d40d2d8753ca0f7547e7f9d8046cc900a6b8bd365540ce1a64a5c5f25d6cd

    • SSDEEP

      12288:88shHAVBuQBBed37dG1lFlWcYT70pxnnaaoawMRVcTqSA+9rZNrI0AilFEvxHvBR:V3s4MROxnF9LqrZlI0AilFEvxHi7o

    Score
    10/10
    orcusratspywarestealer

    • Orcus

      Orcus is a Remote Access Trojan that is being sold on underground forums.

      ratspywarestealerorcus

    • Orcus main payload

    • Orcurs Rat Executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Drops desktop.ini file(s)

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks