Overview

overview

10

Static

static

10

Orcus.exe

windows10-2004-x64

10

Orcus.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Orcus.exe
  • Size 3.0MB
  • Sample260813-tj1ndaca32
  • SHA256 393701f73e155bc474629b7ace8c538e1de6a24c943f3ce38a18912d1ba3a718
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
orcusdiscoveryexecutionpersistenceratspywarestealer

Malware Config

Extracted

Family

  • orcus

C2

  • 87.120.187.0:13511

Mutex

  • d953cd44c38440578b020479dfd4869d

Attributes
  • autostart_method

    TaskScheduler

  • enable_keylogger

    true

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\OrcusWatchdog.exe

Targets

    • Target
      Orcus.exe
    • Size 3.0MB
    • SHA256 393701f73e155bc474629b7ace8c538e1de6a24c943f3ce38a18912d1ba3a718
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    discoveryexecutionorcuspersistenceratspywarestealer

    • Contains code to disable Windows Defender

      A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

    • Family: Orcus

      Orcus is a Remote Access Trojan that is being sold on underground forums.

      ratspywarestealerorcus

    • Orcurs Rat Executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks