Extracted

• • Target
    fdf.exe
  • Size 3.0MB
  • SHA256 811cd46ecbb486d7b506e8af90493a9bfded0d43e49d652f9a46c5e5410f853f
  • MD5 4a7b953a5b1e0153d3eaf4c6c24fcfac
  • SHA1 3ea49b448902c9cc55ce01ec1683a5c596c4fb39
  • SHA512 1c496e333b1f2a1c17d66dac720f86272f8ca6d90a0c33afd559322bd00f96b1c0c982dbf561bd3eee5d7156a262aa1788cc650990316854328d95b48b559278
  • SSDEEP 49152:7cONTJmhnmpBZeM9/LwVkFG6X4cFy5FwsAQpDygNAypQxbd2o9JnCmXKqhncFfH1:7crJXlVkzAFwRQprqypSbd2o9JCmX
  • TLSH
    T1FCE512013FEC9D06D0FF2A75E5732DC807B5EE06A652EE4F0940959C0E9B741AE643AB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionorcuspersistenceprivilege_escalationransomwareratspywarestealersuricata

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Family: Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Suricata alert: Orcus RAT Malware Inbound X.509 Certificate

    Network activity triggered a Suricata alert

    suricataorcus

  • Orcurs Rat Executable

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2