Overview

overview

10

Static

static

1

IMG_0250.jpg

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    IMG_0250.jpg

  • Size

    57KB

  • Sample

    241231-13n71ssjav

  • MD5

    f196ed7554baf3998ff2c2da69718061

  • SHA1

    f2345980045674c09a1f1b92b1d9a264c2eaa679

  • SHA256

    e686a0af1c7f6c36e4e11f35c5a7614101643d33af669186fcf554c4fd7a0c91

  • SHA512

    e19e2ff54672b02c6020abcad333235e9785eea545d30af9578c8572568a84569ffca04fee869f02658b31e946cba52fdd7bc2d6a218252c66d8c7861aa97a92

  • SSDEEP

    1536:zbsDYAzdBBHjDNbK4ZqqHvYyHPMF/DrbcR8H0YW44CnIZpKXZFqaXndO+dm:H7AzdBBHjDNBTMFLrgR5cIUfqQdlm

Score
10/10
orcusdiscoverypersistencephishingprivilege_escalationratspywarestealer

Malware Config

Targets

    • Target

      IMG_0250.jpg

    • Size

      57KB

    • MD5

      f196ed7554baf3998ff2c2da69718061

    • SHA1

      f2345980045674c09a1f1b92b1d9a264c2eaa679

    • SHA256

      e686a0af1c7f6c36e4e11f35c5a7614101643d33af669186fcf554c4fd7a0c91

    • SHA512

      e19e2ff54672b02c6020abcad333235e9785eea545d30af9578c8572568a84569ffca04fee869f02658b31e946cba52fdd7bc2d6a218252c66d8c7861aa97a92

    • SSDEEP

      1536:zbsDYAzdBBHjDNbK4ZqqHvYyHPMF/DrbcR8H0YW44CnIZpKXZFqaXndO+dm:H7AzdBBHjDNBTMFLrgR5cIUfqQdlm

    Score
    10/10
    orcusdiscoverypersistencephishingprivilege_escalationratspywarestealer

    • Orcus

      Orcus is a Remote Access Trojan that is being sold on underground forums.

      ratspywarestealerorcus

    • Orcus family

      orcus

    • Orcurs Rat Executable

    • A potential corporate email address has been identified in the URL: [email protected]

      phishing

    • Event Triggered Execution: Component Object Model Hijacking

      Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

      persistenceprivilege_escalation

    • Executes dropped EXE

    • Loads dropped DLL

    • Modifies system executable filetype association

      persistence

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks