Extracted

• • Target
    HelloUser-main.zip
  • Size 38.2MB
  • SHA256 96f6999876a14b8d74ea2007c987ea2257da7f25c95f25d2e346396c5287b38a
  • MD5 9754f66fe315dc807315862f83c972ab
  • SHA1 398b888c90b98c18b7e141e0cc60ed2323cea427
  • SHA512 76208726c40d8237f3af9abb8b4cc456a7aaffd55d9ba0a1e36021642cd98c0903252b0bff91dd2370760d3605282e1f8095ce340a4518eb9704884b05411f98
  • SSDEEP 786432:jTehlnbuIcDskcLNbLZroksIYBSAduIb/GEVLfXGDG1XF0A/jHQI3e5F:f5IcDENBE3BSaunEV/0AF3e5F
  • TLSH
    T1A29733B4779CD8C976C59447D7CDA126492CAA52BB907008A29DAB015C8FA3F4C87F3F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  nigga ratcollectioncredential_accessdefense_evasiondiscoveryexecutionorcusratspywarestealerupxvmprotect

  • Deletes Windows Defender Definitions

    Uses mpcmdrun utility to delete all AV definitions.

    defense_evasion

  • Family: Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Disables one or more Microsoft Defender components

    Uses the Powershell Set-MpPreference cmdlet to disable one or more Microsoft Defender components.

    defense_evasion

  • Drops file in Drivers directory

  • Clipboard Data

    Adversaries may collect data stored in the clipboard from users copying information within or between applications.

    collection

  • Executes dropped EXE

  • Loads dropped DLL

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • VMProtect packed file

    Detects executables packed with VMProtect commercial packer.

    vmprotect

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Obfuscated Files or Information: Command Obfuscation

    Adversaries may obfuscate content during command execution to impede detection.

    defense_evasion

  • Drops file in System32 directory

  • Enumerates processes with tasklist

    discovery

  • Hide Artifacts: Hidden Files and Directories

    defense_evasion

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1