Overview

overview

10

Static

static

1

22e9bb945d...6b.exe

windows7-x64

10

22e9bb945d...6b.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    40d826bc8a79aa2c6f8534af9456b6c6.bin

  • Size

    698KB

  • Sample

    241129-15e25atlfp

  • MD5

    922e869a46b2903eba7f97ed5b9e2532

  • SHA1

    c5483d202a5f5f0c1ad07cf320f9074c09327137

  • SHA256

    5fc95651ac1eb7179bd6ec58003897861aa659148ed62d986e7db0707db2b611

  • SHA512

    e08addf64b3c20b62daae159ab5c6a18e15e42b3220870048b2106b19d131c6bc06ec1a48e090ca563ee1229c36acb746f0b49b26cd6ed274d6dd7ea08780629

  • SSDEEP

    12288:KCc2TR5ovI2p5lsEcIcaPYSlWk6+KgjFM0fRZxXZQ9GAoA2QWeDZCKcx:KCcJvIEDcAok9/pfRPXZA2cDMK4

Score
10/10
orcusdiscoveryratspywarestealer

Malware Config

Extracted

Family

orcus

C2

45.204.82.103:6606

Mutex

c137f83daf6641cd8f12b4695c8f209e

Attributes
  • autostart_method

    Disable

  • enable_keylogger

    false

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\OrcusWatchdog.exe

Targets

    • Target

      22e9bb945d218fe4c34e1ac66c115117a0412cce8096dbdf11417b216cbac36b.exe

    • Size

      992KB

    • MD5

      40d826bc8a79aa2c6f8534af9456b6c6

    • SHA1

      6a8506a1c2b9da5b199080c529d1456c575c3de8

    • SHA256

      22e9bb945d218fe4c34e1ac66c115117a0412cce8096dbdf11417b216cbac36b

    • SHA512

      97dfdb48abc7f968049043ce335be345c57a7e23e41c54d5de3589593f621b6fc55d4c561d84913259ce18bf53ab9e4a3391e09d72e7067c23bca90857fe8346

    • SSDEEP

      24576:ypCPHKEHa10rCwCgWE9rBhh7ZGyjyFkhakMzKE:ypCPHKEm0mwCgFrfh7UyjnhakMzKE

    Score
    10/10
    orcusdiscoveryratspywarestealer

    • Orcus

      Orcus is a Remote Access Trojan that is being sold on underground forums.

      ratspywarestealerorcus

    • Orcus family

      orcus

    • Orcurs Rat Executable

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks