Overview

overview

10

Static

static

10

7ca07775b7...18.exe

windows7-x64

10

7ca07775b7...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7ca07775b734205bd82bd227061e80d7_JaffaCakes118

  • Size

    905KB

  • Sample

    240528-mg3avsfe4x

  • MD5

    7ca07775b734205bd82bd227061e80d7

  • SHA1

    fdbe03348b660c021b0fa112f233fc8a5c1f107b

  • SHA256

    61dc38d73e81f8609da4308ae6b00e67aadac9b97f9718fa0df983a857de078e

  • SHA512

    19787a2c669c4319692e9be7e71857659a5d1f3336bfbe8f30166633613a499c36ca1674fde6728e521925271c7937b7730eabee6e0b8fe2c5eeb5c302518968

  • SSDEEP

    24576:4554MROxnFMptJSJrrcI0AilFEvxHPZsLooS:4QMiqTSJrrcI0AilFEvxHPZ

Score
10/10
orcuspersistenceratspywarestealer

Malware Config

Extracted

Family

orcus

C2

84.201.188.25:7007

Mutex

c3df045112bb4e98baaf9d5767edb094

Attributes
  • autostart_method

    Registry

  • enable_keylogger

    true

  • install_path

    %programfiles%\mctsk.exe

  • reconnect_delay

    10000

  • registry_keyname

    Discord

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\OrcusWatchdog.exe

Targets

    • Target

      7ca07775b734205bd82bd227061e80d7_JaffaCakes118

    • Size

      905KB

    • MD5

      7ca07775b734205bd82bd227061e80d7

    • SHA1

      fdbe03348b660c021b0fa112f233fc8a5c1f107b

    • SHA256

      61dc38d73e81f8609da4308ae6b00e67aadac9b97f9718fa0df983a857de078e

    • SHA512

      19787a2c669c4319692e9be7e71857659a5d1f3336bfbe8f30166633613a499c36ca1674fde6728e521925271c7937b7730eabee6e0b8fe2c5eeb5c302518968

    • SSDEEP

      24576:4554MROxnFMptJSJrrcI0AilFEvxHPZsLooS:4QMiqTSJrrcI0AilFEvxHPZ

    Score
    10/10
    orcuspersistenceratspywarestealer

    • Orcus

      Orcus is a Remote Access Trojan that is being sold on underground forums.

      ratspywarestealerorcus

    • Orcus main payload

    • Orcurs Rat Executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks