orcus

General

Target

7b0ed4f91e2801784eb139e0928eb9688e2ee2f35bd0eeb5ce8d9e7b83199b25
Size

924KB
Sample

241219-bfrbeszmc1
MD5

eb8463d0ce192dbc87e7bdb2f5530afd
SHA1

7012374f28429b0aa8ad469b9fe363466351545f
SHA256

7b0ed4f91e2801784eb139e0928eb9688e2ee2f35bd0eeb5ce8d9e7b83199b25
SHA512

925dfdb9961030bea95c908d40c166b397bca410e0eba5c881fe810e3c3af604df332b556bba5ccc1c53e06b3c1d3b6a94fbde4d6b7c7d448ef78db9b9d29c69
SSDEEP

24576:bCC4MROxnFE3mi9rbEI0AilFEvxH44ooM:bKMiup9rbEI0AilFEvxH4

Score

10^/10

Malware Config

Extracted

Family

orcus

Botnet

TEST_LEO_FAKE

C2

0.0.0.0:1268

Mutex

4b7e745d24cf405ca3d04bd10e33b1c6

Attributes

autostart_method
Registry
enable_keylogger
true
install_path
%programfiles%\Windows_Defender\Defender.exe
reconnect_delay
10000
registry_keyname
W_Defender
taskscheduler_taskname
Orcus
watchdog_path
AppData\Defender.exe

Targets

- Target
  
  7b0ed4f91e2801784eb139e0928eb9688e2ee2f35bd0eeb5ce8d9e7b83199b25
- Size
  
  924KB
- MD5
  
  eb8463d0ce192dbc87e7bdb2f5530afd
- SHA1
  
  7012374f28429b0aa8ad469b9fe363466351545f
- SHA256
  
  7b0ed4f91e2801784eb139e0928eb9688e2ee2f35bd0eeb5ce8d9e7b83199b25
- SHA512
  
  925dfdb9961030bea95c908d40c166b397bca410e0eba5c881fe810e3c3af604df332b556bba5ccc1c53e06b3c1d3b6a94fbde4d6b7c7d448ef78db9b9d29c69
- SSDEEP
  
  24576:bCC4MROxnFE3mi9rbEI0AilFEvxH44ooM:bKMiup9rbEI0AilFEvxH4
Score

10^/10

orcus test_leo_fake discovery rat spyware stealer
- Orcus
  Orcus is a Remote Access Trojan that is being sold on underground forums.
  rat spyware stealer orcus
- Orcus family
  orcus
- Orcus main payload
- Orcurs Rat Executable
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Orcus family

Orcus main payload

Orcurs Rat Executable

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2