General
-
Target
478241c86132a6eb39627abbc9689ebbb2c646cf52a75880432dc12d656671fb
-
Size
3.0MB
-
Sample
240921-bfqd5axglb
-
MD5
832d479717feba64d070366ed01c3675
-
SHA1
31e9312abaa13b1bc5aaba5b9ae9213bc53eb6ef
-
SHA256
478241c86132a6eb39627abbc9689ebbb2c646cf52a75880432dc12d656671fb
-
SHA512
6407d2bf63057cbc5a94ddd6b8edefeb996c81bfd45dedc87fd044de36ac5d4be3abbeb0de6bd5898ade53b1ed370b62e3a3ca4578bfed7b4fb54a4c502538fd
-
SSDEEP
49152:E8vN8QFUwqYZeM9/ZzzBjMkPUayX82+YXAypQxb9ndo9JnCmutncFf0I74gu3kM:Ei0wGGzBjryX82uypSb9ndo9JCm
Malware Config
Extracted
orcus
0.0.0.0:23210
38874e1e50484f7aa3733dd3e2f0a4f0
-
autostart_method
Disable
-
enable_keylogger
false
-
install_path
%programfiles%\Orcus\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
Orcus
-
watchdog_path
AppData\OrcusWatchdog.exe
Targets
-
-
Target
478241c86132a6eb39627abbc9689ebbb2c646cf52a75880432dc12d656671fb
-
Size
3.0MB
-
MD5
832d479717feba64d070366ed01c3675
-
SHA1
31e9312abaa13b1bc5aaba5b9ae9213bc53eb6ef
-
SHA256
478241c86132a6eb39627abbc9689ebbb2c646cf52a75880432dc12d656671fb
-
SHA512
6407d2bf63057cbc5a94ddd6b8edefeb996c81bfd45dedc87fd044de36ac5d4be3abbeb0de6bd5898ade53b1ed370b62e3a3ca4578bfed7b4fb54a4c502538fd
-
SSDEEP
49152:E8vN8QFUwqYZeM9/ZzzBjMkPUayX82+YXAypQxb9ndo9JnCmutncFf0I74gu3kM:Ei0wGGzBjryX82uypSb9ndo9JCm
Score10/10-
Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
-
Orcurs Rat Executable
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-