Overview

overview

10

Static

static

1

IMG_0250.jpg

windows10-ltsc 2021-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    IMG_0250.jpg

  • Size

    57KB

  • Sample

    241231-zg9q6a1kap

  • MD5

    f196ed7554baf3998ff2c2da69718061

  • SHA1

    f2345980045674c09a1f1b92b1d9a264c2eaa679

  • SHA256

    e686a0af1c7f6c36e4e11f35c5a7614101643d33af669186fcf554c4fd7a0c91

  • SHA512

    e19e2ff54672b02c6020abcad333235e9785eea545d30af9578c8572568a84569ffca04fee869f02658b31e946cba52fdd7bc2d6a218252c66d8c7861aa97a92

  • SSDEEP

    1536:zbsDYAzdBBHjDNbK4ZqqHvYyHPMF/DrbcR8H0YW44CnIZpKXZFqaXndO+dm:H7AzdBBHjDNBTMFLrgR5cIUfqQdlm

Score
10/10
orcusdiscoveryratspywarestealer

Malware Config

Targets

    • Target

      IMG_0250.jpg

    • Size

      57KB

    • MD5

      f196ed7554baf3998ff2c2da69718061

    • SHA1

      f2345980045674c09a1f1b92b1d9a264c2eaa679

    • SHA256

      e686a0af1c7f6c36e4e11f35c5a7614101643d33af669186fcf554c4fd7a0c91

    • SHA512

      e19e2ff54672b02c6020abcad333235e9785eea545d30af9578c8572568a84569ffca04fee869f02658b31e946cba52fdd7bc2d6a218252c66d8c7861aa97a92

    • SSDEEP

      1536:zbsDYAzdBBHjDNbK4ZqqHvYyHPMF/DrbcR8H0YW44CnIZpKXZFqaXndO+dm:H7AzdBBHjDNBTMFLrgR5cIUfqQdlm

    Score
    10/10
    orcusdiscoveryratspywarestealer

    • Orcus

      Orcus is a Remote Access Trojan that is being sold on underground forums.

      ratspywarestealerorcus

    • Orcus family

      orcus

    • Orcurs Rat Executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks