Overview

overview

10

Static

static

10

2100e0c559...e1.exe

windows7-x64

10

2100e0c559...e1.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    2100e0c5596f8bf896056a71ed91c8a695198a5b643322cf0eb9f8496a3525e1

  • Size

    3.0MB

  • Sample

    241212-bg88mazjfj

  • MD5

    83cc0cba6f510ad5eb3142f10019e36b

  • SHA1

    e0f4545ef4c967a8a22a1b4790a88b6fe679446b

  • SHA256

    2100e0c5596f8bf896056a71ed91c8a695198a5b643322cf0eb9f8496a3525e1

  • SHA512

    7a87f2dbb054495a1f91b8bd7c1dd232314d3eca1b3b95798af0eb7518a99bd6f585124e9ac9f1f06c144ed9ce6b9efe5bf674141b83ac177484a786948a81fd

  • SSDEEP

    49152:HwVN8QFUwqYZeM9/ZzzBjMkPUayX82+YXAypQxb9ndo9JnCmBWncFf0I74gu3aM:HM0wGGzBjryX82uypSb9ndo9JCm

Score
10/10
orcusinfecteddiscoverypersistenceratspywarestealer

Malware Config

Extracted

Family

orcus

Botnet

infected

C2

198.98.58.93:1488

Mutex

03b150025848404291d3303886afa2a3

Attributes
  • autostart_method

    Registry

  • enable_keylogger

    false

  • install_path

    %programfiles%\WindowsFirewall\runtime.exe

  • reconnect_delay

    10000

  • registry_keyname

    registry

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\Windows_Services.exe

Targets

    • Target

      2100e0c5596f8bf896056a71ed91c8a695198a5b643322cf0eb9f8496a3525e1

    • Size

      3.0MB

    • MD5

      83cc0cba6f510ad5eb3142f10019e36b

    • SHA1

      e0f4545ef4c967a8a22a1b4790a88b6fe679446b

    • SHA256

      2100e0c5596f8bf896056a71ed91c8a695198a5b643322cf0eb9f8496a3525e1

    • SHA512

      7a87f2dbb054495a1f91b8bd7c1dd232314d3eca1b3b95798af0eb7518a99bd6f585124e9ac9f1f06c144ed9ce6b9efe5bf674141b83ac177484a786948a81fd

    • SSDEEP

      49152:HwVN8QFUwqYZeM9/ZzzBjMkPUayX82+YXAypQxb9ndo9JnCmBWncFf0I74gu3aM:HM0wGGzBjryX82uypSb9ndo9JCm

    Score
    10/10
    orcusinfecteddiscoverypersistenceratspywarestealer

    • Orcus

      Orcus is a Remote Access Trojan that is being sold on underground forums.

      ratspywarestealerorcus

    • Orcus family

      orcus

    • Orcurs Rat Executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks