Overview

overview

10

Static

static

10

infected.exe

windows7-x64

10

infected.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    infected.exe

  • Size

    4.1MB

  • Sample

    241025-xsyf6a1lgt

  • MD5

    35c57757e99caab8b45bf7564321bf37

  • SHA1

    fb9fb3464ab80d5de580a008144d75db80f78cd0

  • SHA256

    4ffffb110dcd98919963c86d3670c78010e72543f300df09a3e609b7d4a925e7

  • SHA512

    239d2ddd2dc7e9796888671e2b1c04f9818af77ff13f067dc89095dbd4a67dec1d598ee9d1f6835bfa41fafb00b2c8c4c40226b0c1cca00937c912a7ff08b8b5

  • SSDEEP

    49152:b4lEncGp+7N+IsAgixvGIl6xNwYzVIGVqdUF4Zm5Ck+W1ClobS5oeEGwWxG/nRFS:b4lEnBp+psixvGqap3Id2Qmj6q2AGZ

Score
10/10
orcusdiscoveryratspywarestealer

Malware Config

Targets

    • Target

      infected.exe

    • Size

      4.1MB

    • MD5

      35c57757e99caab8b45bf7564321bf37

    • SHA1

      fb9fb3464ab80d5de580a008144d75db80f78cd0

    • SHA256

      4ffffb110dcd98919963c86d3670c78010e72543f300df09a3e609b7d4a925e7

    • SHA512

      239d2ddd2dc7e9796888671e2b1c04f9818af77ff13f067dc89095dbd4a67dec1d598ee9d1f6835bfa41fafb00b2c8c4c40226b0c1cca00937c912a7ff08b8b5

    • SSDEEP

      49152:b4lEncGp+7N+IsAgixvGIl6xNwYzVIGVqdUF4Zm5Ck+W1ClobS5oeEGwWxG/nRFS:b4lEnBp+psixvGqap3Id2Qmj6q2AGZ

    Score
    10/10
    orcusdiscoveryratspywarestealer

    • Orcus

      Orcus is a Remote Access Trojan that is being sold on underground forums.

      ratspywarestealerorcus

    • Orcus family

      orcus

    • Orcus main payload

    • Orcurs Rat Executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

      spywarestealer

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks