orcus

General

Target

b7684262403dfa08b0437910fbe72e02bc42ab2efb40ba9e1b7e9b291446dd5b
Size

915KB
Sample

241124-b3s4jaxnas
MD5

8161206e41902fdf459614805090f425
SHA1

1b97a4f47ba33e17d3e583426731ae75b8d7b1a7
SHA256

b7684262403dfa08b0437910fbe72e02bc42ab2efb40ba9e1b7e9b291446dd5b
SHA512

8b4369ca1f21eaedb41e9ca816abce19a7a3c61244795862b8268fa135f6ff6abbf0121ecc71cd400e96c4ef813f4ff4bc42c5df1a469df4a0a501ed43d9ae36
SSDEEP

24576:YmHR4MROxnFi3Is4rrcI0AilFEvxHPmook:7uMioN4rrcI0AilFEvxHP

Score

10^/10

Malware Config

Extracted

Family

orcus

C2

192.168.0.103:6969

Mutex

a289f5162e614f13a5cf125c6e24e771

Attributes

autostart_method
TaskScheduler
enable_keylogger
true
install_path
%programfiles%\Orcus\Orcus.exe
reconnect_delay
10000
registry_keyname
Orcus
taskscheduler_taskname
Orcus
watchdog_path
AppData\OrcusWatchdog.exe

Targets

- Target
  
  b7684262403dfa08b0437910fbe72e02bc42ab2efb40ba9e1b7e9b291446dd5b
- Size
  
  915KB
- MD5
  
  8161206e41902fdf459614805090f425
- SHA1
  
  1b97a4f47ba33e17d3e583426731ae75b8d7b1a7
- SHA256
  
  b7684262403dfa08b0437910fbe72e02bc42ab2efb40ba9e1b7e9b291446dd5b
- SHA512
  
  8b4369ca1f21eaedb41e9ca816abce19a7a3c61244795862b8268fa135f6ff6abbf0121ecc71cd400e96c4ef813f4ff4bc42c5df1a469df4a0a501ed43d9ae36
- SSDEEP
  
  24576:YmHR4MROxnFi3Is4rrcI0AilFEvxHPmook:7uMioN4rrcI0AilFEvxHP
Score

10^/10

orcus discovery rat spyware stealer
- Orcus
  Orcus is a Remote Access Trojan that is being sold on underground forums.
  rat spyware stealer orcus
- Orcus family
  orcus
- Orcus main payload
- Orcurs Rat Executable
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Orcus family

Orcus main payload

Orcurs Rat Executable

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2