orcus | 519bcced29022f139097cc2c56c9e3489329bb63017f202dd15b5234c2d76d0f | Triage

Submit
Reports

Overview

overview

Static

static

AAservices.exe

windows10-2004-x64

Sharing

General

Target

AAservices.exe
Size

5.2MB
Sample

250329-af74havtb1
MD5

b6d4cf90524ad23f23b424d2fc026301
SHA1

4350535f3206ea439d2d320b06eaa0ab9141406e
SHA256

519bcced29022f139097cc2c56c9e3489329bb63017f202dd15b5234c2d76d0f
SHA512

6ccfd3376c47d1dc0615ce54adef257b69398b61c8cd9ec89044150d0c027eb6ee54e8955a34b953b849f935265f846583e30ca414e493f397cbb94446540910
SSDEEP

98304:5v6FYeZ3vFpkRmGWoTxi0wGGzBjryX82uypSb9ndo9JCmVq2q:QFYeZ3vFpkRRdwB3ys2uypSZ4JCEq2q

Score

10^/10

orcus stormkitty defense_evasion discovery execution rat spyware stealer

Static task

static1

orcus stormkitty

5 signatures

Behavioral task

behavioral1

Sample

AAservices.exe

Resource

win10v2004-20250314-en

orcus stormkitty defense_evasion discovery execution rat spyware stealer

windows10-2004-x64

21 signatures

150 seconds

Malware Config

Targets

- Target
  
  AAservices.exe
- Size
  
  5.2MB
- MD5
  
  b6d4cf90524ad23f23b424d2fc026301
- SHA1
  
  4350535f3206ea439d2d320b06eaa0ab9141406e
- SHA256
  
  519bcced29022f139097cc2c56c9e3489329bb63017f202dd15b5234c2d76d0f
- SHA512
  
  6ccfd3376c47d1dc0615ce54adef257b69398b61c8cd9ec89044150d0c027eb6ee54e8955a34b953b849f935265f846583e30ca414e493f397cbb94446540910
- SSDEEP
  
  98304:5v6FYeZ3vFpkRmGWoTxi0wGGzBjryX82uypSb9ndo9JCmVq2q:QFYeZ3vFpkRRdwB3ys2uypSZ4JCEq2q
Score

10^/10

orcus stormkitty defense_evasion discovery execution rat spyware stealer
- Orcus
  Orcus is a Remote Access Trojan that is being sold on underground forums.
  rat spyware stealer orcus
- Orcus family
  orcus
- StormKitty
  StormKitty is an open source info stealer written in C#.
  stealer stormkitty
- StormKitty payload
- Stormkitty family
  stormkitty
- Orcurs Rat Executable
- Downloads MZ/PE file
- Stops running service(s)
  defense_evasion execution
behavioral1

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

Service Execution

Persistence

Create or Modify System Process

Windows Service

Privilege Escalation

Create or Modify System Process

Windows Service

Defense Evasion

Impair Defenses

Credential Access

Discovery

Browser Information Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

Tasks

static1

orcusstormkitty

behavioral1

orcusstormkittydefense_evasiondiscoveryexecutionratspywarestealer

© 2018-2025

Terms | Privacy