Extracted

• • Target

    UZI.bat

  • Size

    1.1MB

  • MD5

    8704d08e0f525a4845031d66f64382ac

  • SHA1

    a2f1438cbfa9692a467d816bbd04658191567719

  • SHA256

    6eb1179500bba11bb328612e0938cd5753d6569a45882a0ecc210f29fa5a7d54

  • SHA512

    3fca1309c6c02d917d67531f8083039812c9ba70bce4e6b3f8b3f7ece9229ab9598ecf5aeb56df4825f43264fba18c9f2cd2c0a4f7516d8fbe8ba5cc7db42b45

  • SSDEEP

    24576:Fam4MROxnF4HrrcI0AilFEvxHPRZoo1jXb2:FOMiaHrrcI0AilFEvxHPjr

  Score

  10^/10

  orcusdefense_evasionratspywarestealerbootkitpersistence

  • Modifies security service

    defense_evasion

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcus family

    orcus

  • Suspicious use of NtCreateProcessExOtherParentProcess

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Orcurs Rat Executable

  • Sets service image path in registry

    persistence

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Indicator Removal: Clear Windows Event Logs

    Clear Windows Event Logs to hide the activity of an intrusion.

    defense_evasion

  • Loads dropped DLL

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Writes to the Master Boot Record (MBR)

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence

  • Drops file in System32 directory

  behavioral1behavioral2