Overview

overview

10

Static

static

10

test12.exe

windows7-x64

10

test12.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    test12.exe

  • Size

    903KB

  • Sample

    250223-mwd7ksvmy9

  • MD5

    5a6bcf9eb3129e9a7b6adf6d19d72318

  • SHA1

    0694b512150fd78da0ca07ff548e8cb606198a01

  • SHA256

    6635055165b35a2717278e356e821be220f289e65e6de4a950573624ccc8ad9a

  • SHA512

    56d2dd02a5d006e110dc5bd678fd55fc925cde62d2769e94ed257b20a1b4b427d3ec8888e869b270b9496ecd68fb65e9e8d09b41d9d046b9beabbd42e2cee9d1

  • SSDEEP

    24576:OVWC4MROxnFwHrrcI0AilFEvxHPJnmooN:OqMiCHrrcI0AilFEvxHP

Score
10/10
orcusdiscoveryratspywarestealer

Malware Config

Extracted

Family

orcus

C2

35.154.189.194:13698

Mutex

657915a5d89f45b38d3d2a41da3c675e

Attributes
  • autostart_method

    Disable

  • enable_keylogger

    false

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\OrcusWatchdog.exe

Targets

    • Target

      test12.exe

    • Size

      903KB

    • MD5

      5a6bcf9eb3129e9a7b6adf6d19d72318

    • SHA1

      0694b512150fd78da0ca07ff548e8cb606198a01

    • SHA256

      6635055165b35a2717278e356e821be220f289e65e6de4a950573624ccc8ad9a

    • SHA512

      56d2dd02a5d006e110dc5bd678fd55fc925cde62d2769e94ed257b20a1b4b427d3ec8888e869b270b9496ecd68fb65e9e8d09b41d9d046b9beabbd42e2cee9d1

    • SSDEEP

      24576:OVWC4MROxnFwHrrcI0AilFEvxHPJnmooN:OqMiCHrrcI0AilFEvxHP

    Score
    10/10
    orcusdiscoveryratspywarestealer

    • Orcus

      Orcus is a Remote Access Trojan that is being sold on underground forums.

      ratspywarestealerorcus

    • Orcus family

      orcus

    • Orcurs Rat Executable

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks