Overview

overview

10

Static

static

3

9667a845e4...18.exe

windows7-x64

10

9667a845e4...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9667a845e450e37f530aa6b66b12d8cc_JaffaCakes118

  • Size

    2.8MB

  • Sample

    240814-rfbtqs1dll

  • MD5

    9667a845e450e37f530aa6b66b12d8cc

  • SHA1

    ec161be67bc5dd933208a43af1a9d0ea855e92b7

  • SHA256

    1aa417fb46cf1d96484fe54ad25cf66105e9b5e2cef735a836e5d57962540f53

  • SHA512

    d6eec1a78ec332d8dd04d89d84e9ef29acf3e5c1ad834ecd5facec6271e19496c07b05823046e5bb358050021b84309139421795b28f19e09c9f321bc29820d4

  • SSDEEP

    49152:JrJiw+BYlgu6pIrPEQCxVrJS8O17uAIgiC/HVMlrJdvJtgf1j6RuJsrn:Jdg9pEP/C3rc8zFgiC/HWddvJM0gJ

Score
10/10
orcusratspywarestealer

Malware Config

Targets

    • Target

      9667a845e450e37f530aa6b66b12d8cc_JaffaCakes118

    • Size

      2.8MB

    • MD5

      9667a845e450e37f530aa6b66b12d8cc

    • SHA1

      ec161be67bc5dd933208a43af1a9d0ea855e92b7

    • SHA256

      1aa417fb46cf1d96484fe54ad25cf66105e9b5e2cef735a836e5d57962540f53

    • SHA512

      d6eec1a78ec332d8dd04d89d84e9ef29acf3e5c1ad834ecd5facec6271e19496c07b05823046e5bb358050021b84309139421795b28f19e09c9f321bc29820d4

    • SSDEEP

      49152:JrJiw+BYlgu6pIrPEQCxVrJS8O17uAIgiC/HVMlrJdvJtgf1j6RuJsrn:Jdg9pEP/C3rc8zFgiC/HWddvJM0gJ

    Score
    10/10
    orcusratspywarestealer

    • Orcus

      Orcus is a Remote Access Trojan that is being sold on underground forums.

      ratspywarestealerorcus

    • Core1 .NET packer

      Detects packer/loader used by .NET malware.

    • Orcurs Rat Executable

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks