Overview

overview

10

Static

static

3

fe1f298a4b...4f.exe

windows7-x64

10

fe1f298a4b...4f.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    fe1f298a4baa234b316ae115d0460ea80d4ec857d92db4a1cdf3d88f77d68c4f.exe

  • Size

    3.4MB

  • Sample

    241123-thaqkaxmay

  • MD5

    b19d51d0c42a2b477b4c1a2c0d284325

  • SHA1

    85fc301b798631db0448abb189caad5c645070f5

  • SHA256

    fe1f298a4baa234b316ae115d0460ea80d4ec857d92db4a1cdf3d88f77d68c4f

  • SHA512

    ee74c98ea0f537f2e59cf45e9b9e7f357e74d5e077f3b891e438917d2e7dcbca4374262e489ad67ef9271663abab2ca64180778cd599ae66ac0dd5cba5dacf4f

  • SSDEEP

    49152:jseNGMHAbrb/TKvO90dL3BmAFd4A64nsfJUqzgTR55Infwz1J:jsDh6hP5

Score
10/10
orcustest infected - noinstalldiscoveryratspywarestealer

Malware Config

Extracted

Family

orcus

Botnet

Test Infected - NoInstall

C2

45.91.92.112:8869

Mutex

480e7530af23454fb6a2256578aeeb77

Attributes
  • autostart_method

    Disable

  • enable_keylogger

    false

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    9998

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\OrcusWatchdog.exe

Targets

    • Target

      fe1f298a4baa234b316ae115d0460ea80d4ec857d92db4a1cdf3d88f77d68c4f.exe

    • Size

      3.4MB

    • MD5

      b19d51d0c42a2b477b4c1a2c0d284325

    • SHA1

      85fc301b798631db0448abb189caad5c645070f5

    • SHA256

      fe1f298a4baa234b316ae115d0460ea80d4ec857d92db4a1cdf3d88f77d68c4f

    • SHA512

      ee74c98ea0f537f2e59cf45e9b9e7f357e74d5e077f3b891e438917d2e7dcbca4374262e489ad67ef9271663abab2ca64180778cd599ae66ac0dd5cba5dacf4f

    • SSDEEP

      49152:jseNGMHAbrb/TKvO90dL3BmAFd4A64nsfJUqzgTR55Infwz1J:jsDh6hP5

    Score
    10/10
    orcustest infected - noinstalldiscoveryratspywarestealer

    • Orcus

      Orcus is a Remote Access Trojan that is being sold on underground forums.

      ratspywarestealerorcus

    • Orcus family

      orcus

    • Orcus main payload

    • Orcurs Rat Executable

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks