Overview

overview

10

Static

static

1

Nouveau do...te.txt

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    Nouveau document texte.txt
  • Size 191B
  • Sample260907-2a3elswhkb
  • SHA256 6ea0389e0f3305f5a92c1b187d558004fdeb74581dac4fbf066feac76207ef3f
  • MD5 SHA1 SHA512 TLSH
Score
10/10
orcusunkcrypterdiscoveryexecutionpersistenceratspywarestealersuricata

Malware Config

Extracted

Language

  • ps1

Deobfuscated
Source
URLs
  • exe.dropper

    https://serenitymindtherapy.site/assets/assets/e.txt

Extracted

Family

  • orcus

Botnet

  • UnkCrypter

C2

  • 45.74.38.211:4782

Mutex

  • 8530ff77d64b4a83bf45d9444bf299ed

Attributes
  • autostart_method

    Disable

  • enable_keylogger

    false

  • install_path

    %programfiles%\Realtek\RealtekDrivers.exe

  • reconnect_delay

    10000

  • registry_keyname

    SmartScreen

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\OrcusWatchdog.exe

Targets

    • Target
      Nouveau document texte.txt
    • Size 191B
    • SHA256 6ea0389e0f3305f5a92c1b187d558004fdeb74581dac4fbf066feac76207ef3f
    • MD5 SHA1 SHA512 TLSH
    Score
    10/10
    unkcrypterdiscoveryexecutionorcuspersistenceratspywarestealersuricata

    • Family: Orcus

      Orcus is a Remote Access Trojan that is being sold on underground forums.

      ratspywarestealerorcus

    • Orcus main payload

    • Suricata alert: Orcus RAT Malware Inbound X.509 Certificate

      Network activity triggered a Suricata alert

      suricataorcus

    • Orcurs Rat Executable

    • Badlisted process makes network request

      Network request originating from process or tool commonly abused by malware.

    • Command and Scripting Interpreter: PowerShell

      Powershell Invoke Web Request.

      execution

    • Downloads MZ/PE file

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious clipboard content.

      A suspicious script was copied to clipboard.

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v16

Tasks