General
- Target 250602-1sn49swwgz.bin
- Size 466.8MB
- Sample250602-2bvfdswyat
- SHA256 bd5ee1f6ebe18c36a0168c43f459f54fd133d35244b269e4ecef5bd2a484c72b
Malware Config
Extracted
-
orcus
-
192.168.171.129:10134
-
pont9245.ddns.net:7777
-
147.185.221.16:18244
-
hostip00.duckdns.org:10134
-
91.218.65.24:10134
-
s7vety-27063.portmap.host:27063
-
kissmyasshole.myddns.me:1012
-
186d21ec80e143edb3384fa80d4ee7f8
-
autostart_method
Disable
-
enable_keylogger
false
-
install_path
%programfiles%\Orcus\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
Orcus
-
watchdog_path
AppData\OrcusWatchdog.exe
Extracted
-
orcus
-
Roblox script injector
-
youcantfindmelol.ddns.net:10134
-
de0e17d469cc46849280a8cd4d643763
-
autostart_method
Registry
-
enable_keylogger
true
-
install_path
%programfiles%\Java\Java.exe
-
reconnect_delay
10000
-
registry_keyname
Java
-
taskscheduler_taskname
Java Updater
-
watchdog_path
Temp\Java Updater.exe
Extracted
-
orcus
-
NEW
-
122.186.23.243:10134
-
c7798e5973374c92859ce651077d0576
-
autostart_method
Registry
-
enable_keylogger
true
-
install_path
%windir%\Desktop Window Manager.exe
-
reconnect_delay
10000
-
registry_keyname
Program
-
taskscheduler_taskname
Windows
-
watchdog_path
AppData\OrcusWatchdog.exe
Extracted
-
orcus
-
EMVLATEST
-
3.tcp.eu.ngrok.io:22028
-
699ea505fbd445a7924b6888db7a5f2a
-
autostart_method
Registry
-
enable_keylogger
true
-
install_path
%programfiles%\Windows Security\Microsoft Defender.exe
-
reconnect_delay
10000
-
registry_keyname
javaservice
-
taskscheduler_taskname
win10service
-
watchdog_path
AppData\javaforwin.exe
Extracted
-
asyncrat
-
0.5.7B
-
Default
-
friendlyman69.ddns.net:55042
-
AsyncMutex_6SI8OkPnk
-
delay
3
-
install
true
-
install_file
lsass.exe
-
install_folder
%AppData%
Extracted
-
darkcomet
- gencode
-
install
false
-
offline_keylogger
false
-
persistence
false
Extracted
-
xworm
-
5.0
-
127.0.0.1:5555
-
hostz.hopto.org:5555
-
172.65.175.19:443
-
127.0.0.1:7000
-
council-amp.gl.at.ply.gg:59436
-
28.ip.gl.ply.gg:65453
-
Nyv6QFoXtqKjtLri
-
Install_directory
%Userprofile%
-
install_file
DMA Driver.exe
Extracted
-
nanocore
-
1.2.2.0
-
90.120.50.244:2518
-
127.0.0.1:2518
-
6baeca53-6eec-4a83-8679-c479f2f1a649
-
activate_away_mode
true
-
backup_connection_host
127.0.0.1
-
backup_dns_server
8.8.4.4
-
buffer_size
65535
-
build_time
2020-11-20T17:31:41.353489336Z
-
bypass_user_account_control
false
-
bypass_user_account_control_data
PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTE2Ij8+DQo8VGFzayB2ZXJzaW9uPSIxLjIiIHhtbG5zPSJodHRwOi8vc2NoZW1hcy5taWNyb3NvZnQuY29tL3dpbmRvd3MvMjAwNC8wMi9taXQvdGFzayI+DQogIDxSZWdpc3RyYXRpb25JbmZvIC8+DQogIDxUcmlnZ2VycyAvPg0KICA8UHJpbmNpcGFscz4NCiAgICA8UHJpbmNpcGFsIGlkPSJBdXRob3IiPg0KICAgICAgPExvZ29uVHlwZT5JbnRlcmFjdGl2ZVRva2VuPC9Mb2dvblR5cGU+DQogICAgICA8UnVuTGV2ZWw+SGlnaGVzdEF2YWlsYWJsZTwvUnVuTGV2ZWw+DQogICAgPC9QcmluY2lwYWw+DQogIDwvUHJpbmNpcGFscz4NCiAgPFNldHRpbmdzPg0KICAgIDxNdWx0aXBsZUluc3RhbmNlc1BvbGljeT5QYXJhbGxlbDwvTXVsdGlwbGVJbnN0YW5jZXNQb2xpY3k+DQogICAgPERpc2FsbG93U3RhcnRJZk9uQmF0dGVyaWVzPmZhbHNlPC9EaXNhbGxvd1N0YXJ0SWZPbkJhdHRlcmllcz4NCiAgICA8U3RvcElmR29pbmdPbkJhdHRlcmllcz5mYWxzZTwvU3RvcElmR29pbmdPbkJhdHRlcmllcz4NCiAgICA8QWxsb3dIYXJkVGVybWluYXRlPnRydWU8L0FsbG93SGFyZFRlcm1pbmF0ZT4NCiAgICA8U3RhcnRXaGVuQXZhaWxhYmxlPmZhbHNlPC9TdGFydFdoZW5BdmFpbGFibGU+DQogICAgPFJ1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+ZmFsc2U8L1J1bk9ubHlJZk5ldHdvcmtBdmFpbGFibGU+DQogICAgPElkbGVTZXR0aW5ncz4NCiAgICAgIDxTdG9wT25JZGxlRW5kPmZhbHNlPC9TdG9wT25JZGxlRW5kPg0KICAgICAgPFJlc3RhcnRPbklkbGU+ZmFsc2U8L1Jlc3RhcnRPbklkbGU+DQogICAgPC9JZGxlU2V0dGluZ3M+DQogICAgPEFsbG93U3RhcnRPbkRlbWFuZD50cnVlPC9BbGxvd1N0YXJ0T25EZW1hbmQ+DQogICAgPEVuYWJsZWQ+dHJ1ZTwvRW5hYmxlZD4NCiAgICA8SGlkZGVuPmZhbHNlPC9IaWRkZW4+DQogICAgPFJ1bk9ubHlJZklkbGU+ZmFsc2U8L1J1bk9ubHlJZklkbGU+DQogICAgPFdha2VUb1J1bj5mYWxzZTwvV2FrZVRvUnVuPg0KICAgIDxFeGVjdXRpb25UaW1lTGltaXQ+UFQwUzwvRXhlY3V0aW9uVGltZUxpbWl0Pg0KICAgIDxQcmlvcml0eT40PC9Qcmlvcml0eT4NCiAgPC9TZXR0aW5ncz4NCiAgPEFjdGlvbnMgQ29udGV4dD0iQXV0aG9yIj4NCiAgICA8RXhlYz4NCiAgICAgIDxDb21tYW5kPiIjRVhFQ1VUQUJMRVBBVEgiPC9Db21tYW5kPg0KICAgICAgPEFyZ3VtZW50cz4kKEFyZzApPC9Bcmd1bWVudHM+DQogICAgPC9FeGVjPg0KICA8L0FjdGlvbnM+DQo8L1Rhc2s+
-
clear_access_control
true
-
clear_zone_identifier
false
-
connect_delay
4000
-
connection_port
2518
-
default_group
Default
-
enable_debug_mode
true
-
gc_threshold
1.048576e+07
-
keep_alive_timeout
30000
-
keyboard_logging
false
-
lan_timeout
2500
-
max_packet_size
1.048576e+07
-
mutex
6baeca53-6eec-4a83-8679-c479f2f1a649
-
mutex_timeout
5000
-
prevent_system_sleep
false
-
primary_connection_host
90.120.50.244
-
primary_dns_server
8.8.8.8
-
request_elevation
false
-
restart_delay
5000
-
run_delay
0
-
run_on_startup
false
-
set_critical_process
false
-
timeout_interval
5000
-
use_custom_dns_server
false
-
version
1.2.2.0
-
wan_timeout
8000
Extracted
-
xworm
-
studies-license.gl.at.ply.gg:48057
-
dpwekwpd-58261.portmap.io:58261
-
127.0.0.1:7000
-
127.0.0.1:2321
-
133.23.21.222:2321
-
28.ip.gl.ply.gg:65453
-
Install_directory
%ProgramData%
-
install_file
USB.exe
Extracted
-
umbral
-
https://discord.com/api/webhooks/1367163929452613703/0Ot4VsdGUKWdMg4T-pgsrzxgFAOyvGEFGDEYD7_CrEfiWkjJTQFitsIjIZavpL8rfypz
Extracted
-
orcus
-
NOOB NONAME
-
26.223.23.213:25565
-
378fcdd4ef824c7db5946dd1cf8ec64f
-
autostart_method
Registry
-
enable_keylogger
true
-
install_path
%programfiles%\Orcus\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
Orcus
-
watchdog_path
Temp\OrcusWatchdog.exe
Extracted
-
ps1
-
exe.dropper
http://zhongsijiacheng.com/wp-content/jn5/
-
exe.dropper
http://artistascitizen.com/wp-content/Bx3cr6/
-
exe.dropper
http://ombchardin.com/archive/V/
-
exe.dropper
https://apsolution.work/magneti-marelli-zkkmb/toq7Eiy/
-
exe.dropper
https://happycheftv.com/wp-admin/z6uGcbY/
-
exe.dropper
https://careercoachconnection.com/tenderometer/4K/
-
exe.dropper
https://tacademicos.com/content/JbF68i/
Extracted
-
xlm4.0
-
xlm40.dropper
http://www.toteteca.com/qzkiodlofm/5555555555.jpg
Extracted
-
ps1
-
exe.dropper
http://zenithcampus.com/l/yQ/
-
exe.dropper
http://hbprivileged.com/cgi-bin/kcggF/
-
exe.dropper
http://localaffordableroofer.com/ralphs-receipt-f2uhf/qTT5DC/
-
exe.dropper
https://johnhaydenwrites.com/track_url/P/
-
exe.dropper
https://nahlasolimandesigns.com/nahla3/d/
-
exe.dropper
https://football-eg.com/web_map/n/
-
exe.dropper
https://vietnhabienhoa.com/wordpress/QUTy/
Targets
-
- Target uploaded/057c3508b21674c3ab95c4c0f26a7195a6aba8d35464dfc97d96452479d430de.exe
- Size 2.7MB
- SHA256 057c3508b21674c3ab95c4c0f26a7195a6aba8d35464dfc97d96452479d430de
Score7/10-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
- Target uploaded/0f0d2abea57c5403fb538eef2e42d5003.exe
- Size 409KB
- SHA256 f7f8ca0ae4af42baa3586561ce73cea45445e439eec867091704a696de334e96
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
- Target uploaded/0fec46875e62cf4c572c4cc4cc7e84374.exe
- Size 73KB
- SHA256 d423b582ccf801825bf5a60d1c0a0ffdf5b06704507f327873d4790029753ffe
Score5/10-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
- Target uploaded/1.exe
- Size 913KB
- SHA256 6b4adc3f05b6f7968d826b26b6a472ad3906a5b659eae167bd3a922415c6133d
Score6/10-
Drops desktop.ini file(s)
-
- Target uploaded/123.exe
- Size 903KB
- SHA256 94ad5e95fc0167221e93b241d4890649158fb8a59272d9e96ad741d3b7e51fff
Score10/10-
Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
-
Orcus family
-
Orcurs Rat Executable
-
- Target uploaded/1546d38e814b5348b877ade61fa7cc0f7.exe
- Size 73KB
- SHA256 ba06a9df44bb8d2439f9ec8ef3cf7ab8349abdc9dc60593f5718785ceb4e7e76
Score5/10-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
- Target uploaded/1812b1b80810a47d68157ec25c3a44e7b.exe
- Size 124KB
- SHA256 790353165b689048a77a6aa76010b561db500d85e3d3509b1ce869204129de49
Score6/10-
Writes to the Master Boot Record (MBR)
Bootkits write to the MBR to gain persistence at a level below the operating system.
-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
- Target uploaded/19a972ce0137c326e9a800096bc442276468096ad02c6dec2aba37564d0e441e.exe
- Size 1.9MB
- SHA256 19a972ce0137c326e9a800096bc442276468096ad02c6dec2aba37564d0e441e
Score1/10 -
- Target Archivo_2001_2021_49-381887.doc
- Size 158KB
- SHA256 89680559595f62f12bfdd9338c525133244ea6b7f23bb9b5b798ce04232817f0
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
- Target Refusal-217432546-01212021.xlsm
- Size 25KB
- SHA256 70a5d9ef163f6e6c7e32c366363d7d4e9a6cbb06df84802edd177acb907fe092
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Process spawned suspicious child process
This child process is typically not spawned unless (for example) the parent process crashes. This typically indicates the parent process was unsuccessfully compromised.
-
- Target uploaded/222.exe
- Size 907KB
- SHA256 b2f324d6ae851aa65773d233201d58ac5230d525281afd1775e0b82514ac9645
Score10/10-
Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
-
Orcus family
-
Orcus main payload
-
Orcurs Rat Executable
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Drops desktop.ini file(s)
-
- Target uploaded/2531 2212 2020 QG-826729.doc
- Size 213KB
- SHA256 3a15b42c4692483aedb912298719b52e5513cf3d2a58ffca07c78fa8c48b536c
Score10/10-
Process spawned unexpected child process
This typically indicates the parent process was compromised via an exploit or macro.
-
Blocklisted process makes network request
-
Command and Scripting Interpreter: PowerShell
Run Powershell and hide display window.
-
- Target uploaded/25f2c4054d0680fd51f2cf860055f2234.exe
- Size 162KB
- SHA256 b3fb1ae7923313ad51ec2101c28fd1f1417cc987f33272227fdc1745c5e5261b
Score3/10 -
- Target uploaded/2bb792ea1927ddd3a5a245eaf96c06ca2598191f670750c24d5b9ed47f20e147.exe
- Size 9.8MB
- SHA256 2bb792ea1927ddd3a5a245eaf96c06ca2598191f670750c24d5b9ed47f20e147
Score7/10-
Loads dropped DLL
-
- Target uploaded/2e5473aa5ebf01ac5ce00c7ad537ddcb2.exe
- Size 73KB
- SHA256 43e54d4e4f485f789739694024b6136f5e5215172555a846608abc8f5386c19a
Score5/10-
UPX packed file
Detects executables packed with UPX/modified UPX open source packer.
-
- Target uploaded/387812ee2820cbf49812b1b229b7d8721ee37296f7b6018332a56e30a99e1092.exe
- Size 144KB
- SHA256 387812ee2820cbf49812b1b229b7d8721ee37296f7b6018332a56e30a99e1092
Score3/10 -
- Target uploaded/3c8ec4a8a8c3b1fbabc577576da5b70f5ddf3460b68775f3fbfa4fc07b6a7fa4.exe
- Size 11.8MB
- SHA256 3c8ec4a8a8c3b1fbabc577576da5b70f5ddf3460b68775f3fbfa4fc07b6a7fa4
Score8/10-
Command and Scripting Interpreter: PowerShell
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Drops startup file
-
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1