Overview

overview

10

Static

static

10

798494934d...87.exe

windows10-2004-x64

10

798494934d...87.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    798494934d245a7b4d6f542fa8dcb89a705e0c87237f2d3e5520a9b3266d9987.bin
  • Size 3.0MB
  • Sample260609-a5824aat9m
  • SHA256 798494934d245a7b4d6f542fa8dcb89a705e0c87237f2d3e5520a9b3266d9987
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
orcusdiscoverypersistenceratspywarestealer

Malware Config

Extracted

Family

  • orcus

C2

  • boards-jackets.gl.at.ply.gg:65024

Mutex

  • 4231150afb72469eb7b7d39bc2d400bd

Attributes
  • autostart_method

    Registry

  • enable_keylogger

    true

  • install_path

    %programfiles%\WindowsDef\WD.exe

  • reconnect_delay

    10000

  • registry_keyname

    AntivirusRegi

  • taskscheduler_taskname

    WindowsAntivirus

  • watchdog_path

    AppData\Watchdog.exe

Targets

    • Target
      798494934d245a7b4d6f542fa8dcb89a705e0c87237f2d3e5520a9b3266d9987.bin
    • Size 3.0MB
    • SHA256 798494934d245a7b4d6f542fa8dcb89a705e0c87237f2d3e5520a9b3266d9987
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    discoveryorcuspersistenceratspywarestealer

    • Family: Orcus

      Orcus is a Remote Access Trojan that is being sold on underground forums.

      ratspywarestealerorcus

    • Orcurs Rat Executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Drops file in System32 directory

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks