orcus

General

Target

b505f6e7fafa18347c284328726d1bb3060b79eabd93e5abd4e818304ad305d6N
Size

915KB
Sample

250113-dq42dawkbq
MD5

dc9238b0734a5ef282d6a1497fc5e730
SHA1

2cc7368ab3de9f2b8eb33c60d8e8592bc96c16fb
SHA256

b505f6e7fafa18347c284328726d1bb3060b79eabd93e5abd4e818304ad305d6
SHA512

5cb90f8940e82557feb182861ccd59168c1e75e9eb9cf3a83541701503bee31ddecdaf4f61db275572cbfcb07c2ba7c85817e4226e13a836153bd9b435b44900
SSDEEP

24576:IXqP4MROxnFD3h74S4xrZlI0AilFEvxHiNpx:IXjMiJ2rZlI0AilFEvxHiN

Score

10^/10

Malware Config

Extracted

Family

orcus

Botnet

winzip

C2

z3roxl33t.hopto.org:7415

Mutex

676113f043a94b71a3b9dfa0e0dd63be

Attributes

autostart_method
TaskScheduler
enable_keylogger
true
install_path
%programfiles%\winzip data\winzip.exe
reconnect_delay
10000
registry_keyname
winzip service
taskscheduler_taskname
winzip services
watchdog_path
Temp\winzip.exe

Targets

- Target
  
  b505f6e7fafa18347c284328726d1bb3060b79eabd93e5abd4e818304ad305d6N
- Size
  
  915KB
- MD5
  
  dc9238b0734a5ef282d6a1497fc5e730
- SHA1
  
  2cc7368ab3de9f2b8eb33c60d8e8592bc96c16fb
- SHA256
  
  b505f6e7fafa18347c284328726d1bb3060b79eabd93e5abd4e818304ad305d6
- SHA512
  
  5cb90f8940e82557feb182861ccd59168c1e75e9eb9cf3a83541701503bee31ddecdaf4f61db275572cbfcb07c2ba7c85817e4226e13a836153bd9b435b44900
- SSDEEP
  
  24576:IXqP4MROxnFD3h74S4xrZlI0AilFEvxHiNpx:IXjMiJ2rZlI0AilFEvxHiN
Score

10^/10

orcus winzip discovery rat spyware stealer
- Orcus
  Orcus is a Remote Access Trojan that is being sold on underground forums.
  rat spyware stealer orcus
- Orcus family
  orcus
- Orcus main payload
- Orcurs Rat Executable
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE
- Loads dropped DLL
- Drops desktop.ini file(s)
- Drops file in System32 directory
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Orcus family

Orcus main payload

Orcurs Rat Executable

Checks computer location settings

Executes dropped EXE

Loads dropped DLL

Drops desktop.ini file(s)

Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2