Overview

overview

10

Static

static

10

1111111111...22.exe

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    111111111111111111111111111111222222222222222222222.exe
  • Size 3.0MB
  • Sample261025-l4cs2sgx4r
  • SHA256 e8d6b0abac094a449dc3b6860e9bde2d90be052d0476c513b8aa51cf23003cde
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
orcusdiscoverypersistenceratspywarestealer

Malware Config

Extracted

Family

  • orcus

Mutex

  • 1cf6fb4a93a74b4ca8fb2b237a5b797f

Attributes
  • autostart_method

    TaskScheduler

  • enable_keylogger

    false

  • install_path

    %programfiles%\$77Steam\$77conhost.exe

  • private_ip

    172.20.10.3:2837

  • reconnect_delay

    10000

  • registry_keyname

    sex

  • taskscheduler_taskname

    pidor

  • watchdog_path

    AppData\$77svchost.exe

Targets

    • Target
      111111111111111111111111111111222222222222222222222.exe
    • Size 3.0MB
    • SHA256 e8d6b0abac094a449dc3b6860e9bde2d90be052d0476c513b8aa51cf23003cde
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    discoveryorcuspersistenceratspywarestealer

    • Family: Orcus

      Orcus is a Remote Access Trojan that is being sold on underground forums.

      ratspywarestealerorcus

    • Orcurs Rat Executable

    • Executes dropped EXE

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v16

Tasks