Extracted

Extracted

• • Target
    a67e34baacfca98f323981d3b0087f3b.exe
  • Size 6.9MB
  • SHA256 6092579a997945b10d3f279693baa004d180417ccfec941c45eb20705a2b4706
  • MD5 a67e34baacfca98f323981d3b0087f3b
  • SHA1 d22ccae2971df83812acaebc750d9a2c87357fe5
  • SHA512 39c7a33ab14e518a09f4e022c1c61c8b5a88417af3ce5a1769ab8c0fa328a178fcd79a098c4c7f3344df75e2b7cd22ebf6a88d43ad61599c53a3c89d54c29d6d
  • SSDEEP 196608:cALE6dWjWnulUCK9vDfaa1RkYP60bs25rXSNBl66Wncma:a6fuiPrfZ1RBP60bs25rXQ66WnG
  • MD5 SHA1 SHA512 SSDEEP

  Score

  10^/10

  orcusdiscoveryexecutionpersistenceratspywarestealerta505xmrigminer

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcus family

    orcus

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • TA505

    Cybercrime group active since 2015, responsible for families like Dridex and Locky.

    ta505

  • Ta505 family

    ta505

  • XMRig Miner payload

    miner

  • Xmrig family

    xmrig

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • Orcurs Rat Executable

  • Blocklisted process makes network request

  • Command and Scripting Interpreter: PowerShell

    Powershell Invoke Web Request.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates processes with tasklist

    discovery
  behavioral1behavioral2