orcus | 5a4239b41fdaa1ff47ea87a36b7ccc6eba7682fc4f08ad3e0f34b570d0e76096 | Triage

Submit
Reports

Overview

overview

Static

static

AAservices.exe

windows7-x64

AAservices.exe

windows10-2004-x64

Sharing

General

Target

AAservices.exe
Size

5.5MB
Sample

250223-ncw4qavqgj
MD5

239a6304b99ea2baed2e10d8b30b1209
SHA1

2952f62de0b350cbcdd41a4f9976047d13791608
SHA256

5a4239b41fdaa1ff47ea87a36b7ccc6eba7682fc4f08ad3e0f34b570d0e76096
SHA512

9ff6dc63ee280e44fe19745aedaa7cc74e3d669fb11fa8c99202d18b4aead9dd8f2087c1b1de7e27fcf28211c1c4f272032946100433e80ab2e72ec9e4628a12
SSDEEP

98304:G+suOjKx/DaLHcKrbpmZStVZ0wGGzBjryX82uypSb9ndo9JCmTqRq:ouOjKx/DaLHrpmguwB3ys2uypSZ4JC2F

Score

10^/10

orcus stormkitty defense_evasion execution rat spyware stealer

Static task

static1

orcus stormkitty

5 signatures

Behavioral task

behavioral1

Sample

AAservices.exe

Resource

win7-20241010-en

orcus stormkitty defense_evasion execution rat spyware stealer

windows7-x64

12 signatures

150 seconds

Behavioral task

behavioral2

Sample

AAservices.exe

Resource

win10v2004-20250217-en

orcus stormkitty defense_evasion execution rat spyware stealer

windows10-2004-x64

13 signatures

150 seconds

Malware Config

Targets

- Target
  
  AAservices.exe
- Size
  
  5.5MB
- MD5
  
  239a6304b99ea2baed2e10d8b30b1209
- SHA1
  
  2952f62de0b350cbcdd41a4f9976047d13791608
- SHA256
  
  5a4239b41fdaa1ff47ea87a36b7ccc6eba7682fc4f08ad3e0f34b570d0e76096
- SHA512
  
  9ff6dc63ee280e44fe19745aedaa7cc74e3d669fb11fa8c99202d18b4aead9dd8f2087c1b1de7e27fcf28211c1c4f272032946100433e80ab2e72ec9e4628a12
- SSDEEP
  
  98304:G+suOjKx/DaLHcKrbpmZStVZ0wGGzBjryX82uypSb9ndo9JCmTqRq:ouOjKx/DaLHrpmguwB3ys2uypSZ4JC2F
Score

10^/10

orcus stormkitty defense_evasion execution rat spyware stealer
- Orcus
  Orcus is a Remote Access Trojan that is being sold on underground forums.
  rat spyware stealer orcus
- Orcus family
  orcus
- StormKitty
  StormKitty is an open source info stealer written in C#.
  stealer stormkitty
- StormKitty payload
- Stormkitty family
  stormkitty
- Orcurs Rat Executable
- Blocklisted process makes network request
- Stops running service(s)
  defense_evasion execution
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

Service Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

Tasks

static1

orcusstormkitty

behavioral1

orcusstormkittydefense_evasionexecutionratspywarestealer

behavioral2

orcusstormkittydefense_evasionexecutionratspywarestealer

© 2018-2025

Terms | Privacy