Extracted

Extracted

• • Target
    6b8848b38b3e239a0df83efc456ad22bf5e59e7145b59d1f8e154881ebb9f8e3
  • Size 6.9MB
  • SHA256 6b8848b38b3e239a0df83efc456ad22bf5e59e7145b59d1f8e154881ebb9f8e3
  • MD5 5eecc13df41c8e6967f8a3ecb1d0cda9
  • SHA1 8ac9ce30344f976a09da51da509dee5d2b0e8723
  • SHA512 24c981ad16a5bc65738127dc27f2c804f4678671a8c13ff60ef2edcf795b8b6d505d121f407514dfbe7853b5d7577299ae30832319d21e83c5c18f5c638382d1
  • SSDEEP 196608:2ALE6dWjWnulUCK9vDfaa1RkYP60bs25rXSNBl66Wncma:k6fuiPrfZ1RBP60bs25rXQ66WnG
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  orcusta505discoveryexecutionpersistenceratspywarestealerxmrigevasionminer

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcus family

    orcus

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • TA505

    Cybercrime group active since 2015, responsible for families like Dridex and Locky.

    ta505

  • Ta505 family

    ta505

  • XMRig Miner payload

    miner

  • Xmrig family

    xmrig

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • Orcurs Rat Executable

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Disables Task Manager via registry modification

    evasion

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Enumerates processes with tasklist

    discovery
  behavioral1behavioral2