orcus | 3786d314f4e3906400b24657ed15fca047576eba9cf17630246db69503fdbea3

Sharing

Copy URL

Twitter E-mail

General

Target

OrcusRAT-main.zip
Size

25.0MB
Sample

241108-yp7q4ayeqn
MD5

4ebe8621171038676189cbc5e7053d9f
SHA1

2e3a3b97163d1e8af1e41c36f9495062fb4b1934
SHA256

3786d314f4e3906400b24657ed15fca047576eba9cf17630246db69503fdbea3
SHA512

e0091ae9f3acddc7e8d11b89a60debc3dab57b8af57bde4a3f538b2283eae398a1adec8224bf5fd2d0be61be015fc2a79c49b06cf786945073e1cc87d66be356
SSDEEP

786432:DFrAoo07VJxiSdlBx4IVwXuOHKW3kijZk:hrA+xJBgIEuMUiNk

Score

10^/10

orcus

Malware Config

Targets

- Target
  
  OrcusRAT-main/libraries/CSCore.dll
- Size
  
  496KB
- MD5
  
  5e8fe2a84d3076f5d9815b77eb67d4f6
- SHA1
  
  c08f0f706520e1a32b0999bda032c90755f7d374
- SHA256
  
  fd3feefc62097ff785c7fdd524070e25fcaba7e4ce19f5480ecad695dd2a5405
- SHA512
  
  8a5e77aa6f31db39dae45dbb2dc45da717a065f6831552b0133f6defe6551e236226acfc5dfecc93dad1a3457720d8f85a985c71a7591d45755c3f8ff4740438
- SSDEEP
  
  6144:qgnuf8G18h9LKXYTD+XVyX6QgYC/f98+5JBO5blpIz0oG2th9i/J:qgFBKcDFXDgYC/f987Kz19i/
Score

1^/10
behavioral1 behavioral2
- Target
  
  OrcusRAT-main/libraries/Exceptionless.Extras.dll
- Size
  
  71KB
- MD5
  
  d3fcd5038079ef42e23ed39a86af5a31
- SHA1
  
  3977309df5b3ddc0218a800ee463ddcbcae7503e
- SHA256
  
  9d4ab0418d94d3c3d7025ecc1c70ce1762ee12aaa4d35666c2dc7887df53a537
- SHA512
  
  8535e4b5b7b61cf31fe69bd43eb2ba4c2a248a2f2a6efcf9b1ffc9cf4d39b67dcb687d45964054b3900f5aa21662b4acc91302f02e99e819ac6f5827a0d493d0
- SSDEEP
  
  1536:mB4/RmrDkeXDlc4n10Yf6vvB78MFG20es2A1OLv2Nvr838HVHHOU30fKFWHVyePD:m+/IXZTn1BjpemrPEXK7eASoC
Score

1^/10
behavioral3 behavioral4
- Target
  
  OrcusRAT-main/libraries/Exceptionless.Portable.dll
- Size
  
  678KB
- MD5
  
  6aba9f00d64371b940eedc21804ea9eb
- SHA1
  
  5fb0e520a23c780474b0866218c61ff55d083b3f
- SHA256
  
  22c949720dacd2dc19b7744185b18faf53dc18199c36af44158257a08ce7f3fd
- SHA512
  
  9166ff3cfd7adc334f3a98f4a40736c178a1c793f6ca264722bd1b962a3d059d88035eee1f45aab2b45a8692a13ef50c8e762c4c8600937b263fd7c2703185c0
- SSDEEP
  
  12288:js84bq85JQrVPvIxDlm1X4Qz9g35VF7Syj4pYoSpc9UM04uBrAaJZSPZZBrEK8eV:Y4rVImlzqVFWyj4pYoSpc9UM04uBrAa6
Score

1^/10
behavioral5 behavioral6
- Target
  
  OrcusRAT-main/libraries/Exceptionless.Wpf.dll
- Size
  
  26KB
- MD5
  
  609fbfcf1bea7ac58712764cb9e408f1
- SHA1
  
  6831a6338e056540c5305b192b726ea68413f6c2
- SHA256
  
  c14b8c33f9679cf4cf4f80d91698e3f40acdbd82d3b700a8b2813322e5e42ec3
- SHA512
  
  41bc3949421b2179e6208f3677264399f60f81bca69a9cf632e8e8ca4978710885674d76fa635b133b6638cad11813a33a538cbccde7cf482b7e61719e8ceaac
- SSDEEP
  
  384:SO6qmMxrZfvTOtDTjzImcOFz/Ym1T9yQT0B0Am9Z6budtzYi8LkbXgAZyTlaiA1W:8qfOtDbcsz/9NV66HYikQiLEnC
Score

1^/10
behavioral7 behavioral8
- Target
  
  OrcusRAT-main/libraries/FluentCommandLineParser.dll
- Size
  
  43KB
- MD5
  
  9b5e37f89268ccce0e098222004093ad
- SHA1
  
  30b12174abda6a420b2cc152b5c682ff8f106c37
- SHA256
  
  fe068b6f15a5423f86558927dd22ec35070c041db9cde1ecade0590d93ca5285
- SHA512
  
  23e8cbaa6103f5a76729ee8470b5b208d67be22c9b9fa78340055ac8ded04dc6147c8c50cde96f7c10b111f81cab3e5504227ac5b8f1a616c1a1384c6350257f
- SSDEEP
  
  768:U74t6uOtRT8HuJ071hEdOgaaGoCbvfkGujm:Gc6uOtRa/71UO1onLS
Score

1^/10
behavioral10 behavioral9
- Target
  
  OrcusRAT-main/libraries/GongSolutions.Wpf.DragDrop.dll
- Size
  
  53KB
- MD5
  
  dcb1b714646f72939969441ee16e3197
- SHA1
  
  294014a44415bfb8a0415e1c19c7e8763046ffc8
- SHA256
  
  7236cd133dc18064cd57028be5cca18708117c3082f5ca001cb69eaf596a578c
- SHA512
  
  2e2b6fa0918a59915165ed689f524576e94cb4f531c4eac58a74049a187bfdc6d87423150e26dd244bb9b4988b4017afc0b62865f5f686524f60e7512e35679c
- SSDEEP
  
  1536:nvzBUJUgtSMoY0Z9D24W5d7Oi8SXMocAdg17wr:nv0fkDngOi7cocAdnr
Score

1^/10
behavioral11 behavioral12
- Target
  
  OrcusRAT-main/libraries/ICSharpCode.AvalonEdit.dll
- Size
  
  592KB
- MD5
  
  d7467d0156f22feb4b22cc5f74d7bd60
- SHA1
  
  bcc1d959786ba4253491b67d448f97cf5ad709ed
- SHA256
  
  2bf6079c143f177d954731db2ffde515bee8fbd6261e0d338ba8e7c8df1ab658
- SHA512
  
  f13092a4154524226900c8f3089ef776932cae601cb21cc10af1111014aef97a1183a2344da3f5b8f5b9fbe8b4b420412d79b71e97a1b4ed2ec384b502ba1c28
- SSDEEP
  
  6144:64Gybj4PJqJZD0JOi0Av5+ENJzHLeDjN3kNHjoJAo7gOfwlflvuSn:6i4PwJZ1szeDjKRWwl5
Score

1^/10
behavioral13 behavioral14
- Target
  
  OrcusRAT-main/libraries/MahApps.Metro.dll
- Size
  
  918KB
- MD5
  
  fb1e8eee84791cc015e043ab0ce32bba
- SHA1
  
  42fb789011213635a7d022ba4fd5461a0d9a134d
- SHA256
  
  0de72da4bc2d16d39c30368af880d754fa0bd9745897652ba50213e589d265c5
- SHA512
  
  748af415c875cd5d44f305cf58060e7e66ef2ef041b6e86e3a76287a51af63116096eaed0877dc48c17da6594ad0c8dbf0ecadecb763dd469be8b6cc1d02d4a0
- SSDEEP
  
  12288:qADBZgu6aCRVudOz7A+H/uzylD/AcnnnnnnnnnnnnnnnnnnnnnnnGnknnnnnAMxg:qYMRMOzjuuF/AmHRNXmbJtV/
Score

1^/10
behavioral15 behavioral16
- Target
  
  OrcusRAT-main/libraries/Microsoft.Threading.Tasks.dll
- Size
  
  36KB
- MD5
  
  d01819bfe03222dfa9e35a36555b6b6c
- SHA1
  
  25f8069590b14724f28e6a04b8a42e4ef4a8562d
- SHA256
  
  5f29e16edff5379e93d5be9bee4cddf98132b84326027688511ac0f3157aaf94
- SHA512
  
  e63901f39315972e446768f2c14b4279cf1dd382f97ac90c444c4d858c2a486736a259c47245026b11e5c0846310e7da020bf2466ea91aa0a15d22cb67b37477
- SSDEEP
  
  384:AjCan21RTf1FuPIgbSVHfiWvoVZHL+8SChE+QNEv4USWyWcWZ1q//0GftpBjfuHk:A+e21RTrgbSpfihdvF4eg8iUHWTmlr+
Score

1^/10
behavioral17 behavioral18
- Target
  
  OrcusRAT-main/libraries/Mono.Cecil.dll
- Size
  
  274KB
- MD5
  
  6d6292bc8e698e53e69556add6f62442
- SHA1
  
  fab26eb07adab421797689da27ad754aa1c31810
- SHA256
  
  0f6465ce57a0cbabc37013c8e3c9f110672de1c127b6192177d59eb1c7809772
- SHA512
  
  f77c995857bf3c62bd87cce4246d9792d388af33664fbabf05bfcf574ae9332c45013697be7f698bff6cd33b02573abcbeae172b53c75979339e01123c61ae32
- SSDEEP
  
  6144:BaUU67x2AE6gaSTYUs8Nr/gaGGv8+iGKdJDkP0bAZ:biG8Nr/vv8+O
Score

1^/10
behavioral19 behavioral20
- Target
  
  OrcusRAT-main/libraries/NLog.dll
- Size
  
  517KB
- MD5
  
  27c2b96dfbebba578638588d2c95705f
- SHA1
  
  6223920526982da59a93ccb2d733e9bdbb1afbaf
- SHA256
  
  a74414ee5a23d73d879c216d9cfd96a9a8ad048773fe689d8a8b3022c9869cdf
- SHA512
  
  aa90ef4fef936a43c3413c90427668b7956742bb88eb2693d8dc23654952997771e702f5c0b8ffa04e8f0ef8e16809d8bb3ac1f007bc9989b039e78a1d2a6358
- SSDEEP
  
  12288:PNShT6DUsQfOrYqk1CXQdcGASuocRwsCbDRHDh:cNEUsQfOrYqk1CXQdcGASuocRwsCbDRl
Score

1^/10
behavioral21 behavioral22
- Target
  
  OrcusRAT-main/libraries/Newtonsoft.Json.dll
- Size
  
  510KB
- MD5
  
  c3c04754418382f505cafc18d64427f5
- SHA1
  
  cac5e36dc498d6bb16170020be021ff5bd18a9e2
- SHA256
  
  df8ec2e0245829ddec5b79f1918c3ae3a3fa540a5a0e3c410e2b6ef0bebc7927
- SHA512
  
  bda5efd0f69a9c7198841e5d31744fa2bebb05cedb1e2846a0d2dbce6c3193da69c181be1116f38cd5f3d61b441567b1da2c844522184323e3d429294aa91ab5
- SSDEEP
  
  6144:D5AGNDJNY1d2Skc39wf9IsDraDmh7JKH8Vjp4baBmBFSu4oNVg2OUvie:LNYNY9LaDKKGSBTV9
Score

1^/10
behavioral23 behavioral24
- Target
  
  OrcusRAT-main/libraries/Ookii.Dialogs.Wpf.dll
- Size
  
  105KB
- MD5
  
  5926472580c7a7b45cd611dc0fb06244
- SHA1
  
  a3b33bc8c9963f727bc2a2714ec6de0c607bca40
- SHA256
  
  04b8cb55ff481a4f4f9a60bc3c5e06ed78c12a8677c211621edcf9d8467bd823
- SHA512
  
  be05b4695896b4a2ad2ca63836c9d05084b8aa1b71929e1b081fd47b851282438bdf8c7bc65466ce7f3fe30335e743c0bd12aa52670b12d6eaec8b3bfd193056
- SSDEEP
  
  1536:5lPwQgrQnQaIM9MsmdgdSrtP7QdniuLF+mnNuu48pMBqDALYHu+an+HeaP6kOdWF:5lNJIceEMGFHnM8A8HC++aPA3O
Score

1^/10
behavioral25 behavioral26
- Target
  
  OrcusRAT-main/libraries/Orcus.Administration.Commands.dll
- Size
  
  106KB
- MD5
  
  bca25796ab6eaced997fe584d561ab78
- SHA1
  
  c9c509e384756b55167e19aa93f90ca49bf2c184
- SHA256
  
  57d8c94738921a61c25e9022cd77fb84641e31eca86c1ef8fb169a398c068614
- SHA512
  
  56ab28bd0415f4d20f2ae97648f487b0832db80f1e96b620aea07260af9ebd9512214b1a855ed385c5ecfdec198843fb6ebed9562c133ec146662562145c225c
- SSDEEP
  
  3072:cBpsSkwwfiSyt5RgFqB+Myx/CjxaRP0yw:cltwfiSiAqB+MD8a
Score

1^/10
behavioral27 behavioral28
- Target
  
  OrcusRAT-main/libraries/Orcus.Administration.Licensing.dll
- Size
  
  80KB
- MD5
  
  70e207da89961cd32217eabbe3ac0791
- SHA1
  
  305ba309e762a128ae098e5bf0241ba71f3a331e
- SHA256
  
  83f968c6682b0e52b217daa6aa3da21be6967aa194a14631f43cc76c11a142e9
- SHA512
  
  8d9de9a9b3ad265a1df7bd7ab790db639d6ef4b871275a5b2fbb72f9b324cc3158d2073de2de78692fa7ffe64e78e31e7d7f75cb3b50c0d6513da21094bad075
- SSDEEP
  
  1536:I+ILbMdO5V0tqQdHNWNEyieS9pJShPB+Viy6Sp6LRaKN/8:UVavdHNWNEyib9pJShPB+Viy6Sp6LRaN
Score

1^/10
behavioral29 behavioral30
- Target
  
  OrcusRAT-main/libraries/Orcus.Administration.Licensing.pdb
- Size
  
  80KB
- MD5
  
  70e207da89961cd32217eabbe3ac0791
- SHA1
  
  305ba309e762a128ae098e5bf0241ba71f3a331e
- SHA256
  
  83f968c6682b0e52b217daa6aa3da21be6967aa194a14631f43cc76c11a142e9
- SHA512
  
  8d9de9a9b3ad265a1df7bd7ab790db639d6ef4b871275a5b2fbb72f9b324cc3158d2073de2de78692fa7ffe64e78e31e7d7f75cb3b50c0d6513da21094bad075
- SSDEEP
  
  1536:I+ILbMdO5V0tqQdHNWNEyieS9pJShPB+Viy6Sp6LRaKN/8:UVavdHNWNEyib9pJShPB+Viy6Sp6LRaN
Score

1^/10
behavioral31 behavioral32

MITRE ATT&CK Matrix

Tasks

Sharing

General

Malware Config

Targets

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

behavioral2

behavioral3

behavioral4

behavioral5

behavioral6

behavioral7

behavioral8

behavioral9

behavioral10

behavioral11

behavioral12

behavioral13

behavioral14

behavioral15

behavioral16

behavioral17

behavioral18

behavioral19

behavioral20

behavioral21

behavioral22

behavioral23

behavioral24

behavioral25

behavioral26

behavioral27

behavioral28

behavioral29

behavioral30

behavioral31

behavioral32