orcus | 4e0e6745dbb8c9bdb75b60958f533f88143f2677b2921f8b58d7b2d37a429ba5 | Triage

Sharing

General

Target

4e0e6745dbb8c9bdb75b60958f533f88143f2677b2921f8b58d7b2d37a429ba5
Size

3.0MB
Sample

250104-bs12dswlhr
MD5

7fa0a2a46c7438df2f76a52dab406d67
SHA1

8405e23890a0a9569266bfeefb41204ca16eed83
SHA256

4e0e6745dbb8c9bdb75b60958f533f88143f2677b2921f8b58d7b2d37a429ba5
SHA512

317c5b0f1dd1c3be546b64576e21fb766704c13476e31204c0fbf689f1c0a602ee7adb66236ebe47b36942adf873aa7836281715a68a393c83511af7bda2dec0
SSDEEP

49152:ocP+Jt1ZeM9/3EgHcyH4Z9fVTB4krLzS+HAypQxbOqUo9JnCmSPnGFfhIMdOupS:ocPItGjzD5rfLgypSbKo9JCm

Score

10^/10

orcus vt rat spyware stealer

Malware Config

Extracted

Family

orcus

Botnet

VT

C2

91.227.18.174:443

Mutex

c029dcbb5f7d4ee78cd838c6d8e0a92d

Attributes

autostart_method
Disable
enable_keylogger
false
install_path
%programfiles%\Orcus\Orcus.exe
reconnect_delay
10000
registry_keyname
Orcus
taskscheduler_taskname
Orcus
watchdog_path
AppData\OrcusWatchdog.exe

Targets

- Target
  
  4e0e6745dbb8c9bdb75b60958f533f88143f2677b2921f8b58d7b2d37a429ba5
- Size
  
  3.0MB
- MD5
  
  7fa0a2a46c7438df2f76a52dab406d67
- SHA1
  
  8405e23890a0a9569266bfeefb41204ca16eed83
- SHA256
  
  4e0e6745dbb8c9bdb75b60958f533f88143f2677b2921f8b58d7b2d37a429ba5
- SHA512
  
  317c5b0f1dd1c3be546b64576e21fb766704c13476e31204c0fbf689f1c0a602ee7adb66236ebe47b36942adf873aa7836281715a68a393c83511af7bda2dec0
- SSDEEP
  
  49152:ocP+Jt1ZeM9/3EgHcyH4Z9fVTB4krLzS+HAypQxbOqUo9JnCmSPnGFfhIMdOupS:ocPItGjzD5rfLgypSbKo9JCm
Score

10^/10

orcus vt rat spyware stealer
- Orcus
  Orcus is a Remote Access Trojan that is being sold on underground forums.
  rat spyware stealer orcus
- Orcus family
  orcus
- Orcurs Rat Executable
behavioral1 behavioral2

MITRE ATT&CK Matrix

Tasks

static1

behavioral1

orcusvtratspywarestealer

behavioral2

orcusvtratspywarestealer