Overview

overview

10

Static

static

10

test.exe

windows7-x64

10

test.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    test.exe

  • Size

    913KB

  • Sample

    250322-xmgapaspz4

  • MD5

    3ec4232085e107853eb6787e80848efa

  • SHA1

    3cc6617af32cd1da1b7ffc0996a1a32e1a171bf1

  • SHA256

    2c79679727444f53ecabaa6c6d588cefb54b9c118ef858bc7e1fdc913440086a

  • SHA512

    9b7f0d5f9d18b3c54d3c65eb7df0f95a799eaeccd383ef9aae44372896bac2e629d6a26c30c47d6ef839c91559a024a1083bd5f39a3187e63e817638f3d2a999

  • SSDEEP

    24576:7Eqr4MROxnF25bHKTlQjrZlI0AilFEvxHiON:7EjMiwjrZlI0AilFEvxHi

Score
10/10
orcusdiscoveryratspywarestealer

Malware Config

Extracted

Family

orcus

C2

23.160.168.165:7058

Mutex

eb4cdf8f2fdf48e2948ba799aa59ebe5

Attributes
  • autostart_method

    Disable

  • enable_keylogger

    false

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\OrcusWatchdog.exe

Targets

    • Target

      test.exe

    • Size

      913KB

    • MD5

      3ec4232085e107853eb6787e80848efa

    • SHA1

      3cc6617af32cd1da1b7ffc0996a1a32e1a171bf1

    • SHA256

      2c79679727444f53ecabaa6c6d588cefb54b9c118ef858bc7e1fdc913440086a

    • SHA512

      9b7f0d5f9d18b3c54d3c65eb7df0f95a799eaeccd383ef9aae44372896bac2e629d6a26c30c47d6ef839c91559a024a1083bd5f39a3187e63e817638f3d2a999

    • SSDEEP

      24576:7Eqr4MROxnF25bHKTlQjrZlI0AilFEvxHiON:7EjMiwjrZlI0AilFEvxHi

    Score
    10/10
    orcusratspywarestealerdiscovery

    • Orcus

      Orcus is a Remote Access Trojan that is being sold on underground forums.

      ratspywarestealerorcus

    • Orcus family

      orcus

    • Orcus main payload

    • Orcurs Rat Executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Drops desktop.ini file(s)

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks