Overview

overview

10

Static

static

10

f4d1839c9c...ee.exe

windows7-x64

10

f4d1839c9c...ee.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f4d1839c9cf08c78a4764da2dfafa76b9b056fae105ac6d856c931c1651daeee

  • Size

    909KB

  • Sample

    250111-bwfjvsxkcy

  • MD5

    2e28ffac1bbd47f62d62afc8c73be052

  • SHA1

    069841377ae2f05b02e53964b64ae619b091fab3

  • SHA256

    f4d1839c9cf08c78a4764da2dfafa76b9b056fae105ac6d856c931c1651daeee

  • SHA512

    b000033344ff472cca72f4a471b5d000a7611bb05873305b36d320b2f89cef4aa19d61dd6e7af96ac7ecd5255ad0fd2589289b87bc7670ebaa9342f84519a1f2

  • SSDEEP

    24576:6kL94MROxnFOHrrcI0AilFEvxHPeroo3:hWMiMrrcI0AilFEvxHP

Score
10/10
orcusdiscoveryratspywarestealer

Malware Config

Extracted

Family

orcus

C2

192.168.31.232:8488

Mutex

c119ac29a86f4ba4957a5a8f07ffc34b

Attributes
  • autostart_method

    Disable

  • enable_keylogger

    false

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\OrcusWatchdog.exe

Targets

    • Target

      f4d1839c9cf08c78a4764da2dfafa76b9b056fae105ac6d856c931c1651daeee

    • Size

      909KB

    • MD5

      2e28ffac1bbd47f62d62afc8c73be052

    • SHA1

      069841377ae2f05b02e53964b64ae619b091fab3

    • SHA256

      f4d1839c9cf08c78a4764da2dfafa76b9b056fae105ac6d856c931c1651daeee

    • SHA512

      b000033344ff472cca72f4a471b5d000a7611bb05873305b36d320b2f89cef4aa19d61dd6e7af96ac7ecd5255ad0fd2589289b87bc7670ebaa9342f84519a1f2

    • SSDEEP

      24576:6kL94MROxnFOHrrcI0AilFEvxHPeroo3:hWMiMrrcI0AilFEvxHP

    Score
    10/10
    orcusdiscoveryratspywarestealer

    • Orcus

      Orcus is a Remote Access Trojan that is being sold on underground forums.

      ratspywarestealerorcus

    • Orcus family

      orcus

    • Orcurs Rat Executable

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks