Overview

overview

10

Static

static

10

bdcc328375...80.exe

windows7-x64

10

bdcc328375...80.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    bdcc3283758cb498731af1e64fd49e7c118eab8c03b0ecf6186aa7de2f4fa080

  • Size

    2.9MB

  • Sample

    250220-bhqsnssrfy

  • MD5

    07803c2ba4db5c5bca27e6d03df613d4

  • SHA1

    3cbf27f46854654e4d8b3c923a1627626e40507c

  • SHA256

    bdcc3283758cb498731af1e64fd49e7c118eab8c03b0ecf6186aa7de2f4fa080

  • SHA512

    382283e11945d9f4da119b54128ee1e207f61014a64314a4f89d14bfbdfa398697a9595bdab8a1cb2f186c067968ca789b7fc9b6024d0ee9b79f389bb59fc603

  • SSDEEP

    49152:LXt15L9LyfbDZKM76BDzrKyTclctakCyxHiZBM135AypQxbKZRo9JnCmV+PrMRIo:LXtP9Lyj4O6ppclctaZyiy3eypSb4o9l

Score
10/10
orcusartemdiscoveryratspywarestealer

Malware Config

Extracted

Family

orcus

Botnet

artem

C2

officeservice.gotdns.ch:443

Mutex

362ab40cbbb1425eae89cd7437826e2d

Attributes
  • autostart_method

    Disable

  • enable_keylogger

    false

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\OrcusWatchdog.exe

Targets

    • Target

      bdcc3283758cb498731af1e64fd49e7c118eab8c03b0ecf6186aa7de2f4fa080

    • Size

      2.9MB

    • MD5

      07803c2ba4db5c5bca27e6d03df613d4

    • SHA1

      3cbf27f46854654e4d8b3c923a1627626e40507c

    • SHA256

      bdcc3283758cb498731af1e64fd49e7c118eab8c03b0ecf6186aa7de2f4fa080

    • SHA512

      382283e11945d9f4da119b54128ee1e207f61014a64314a4f89d14bfbdfa398697a9595bdab8a1cb2f186c067968ca789b7fc9b6024d0ee9b79f389bb59fc603

    • SSDEEP

      49152:LXt15L9LyfbDZKM76BDzrKyTclctakCyxHiZBM135AypQxbKZRo9JnCmV+PrMRIo:LXtP9Lyj4O6ppclctaZyiy3eypSb4o9l

    Score
    10/10
    orcusartemdiscoveryratspywarestealer

    • Orcus

      Orcus is a Remote Access Trojan that is being sold on underground forums.

      ratspywarestealerorcus

    • Orcus family

      orcus

    • Orcurs Rat Executable

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks