Overview

overview

10

Static

static

3

d61d8e0cb1...18.exe

windows7-x64

10

d61d8e0cb1...18.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    d61d8e0cb1eb7183485f8edb5d9b4eda_JaffaCakes118

  • Size

    1.1MB

  • Sample

    240909-mdg6hssglp

  • MD5

    d61d8e0cb1eb7183485f8edb5d9b4eda

  • SHA1

    04be3c46cffce788b7f8b8f238fa3e3296dfeb13

  • SHA256

    3eb5ab3cc11d0064fc147b145a156c1fa37e37fa9bc4e06b6789098ee4a1201d

  • SHA512

    a59e87a7a623cfa2fea7d855e9f9cb31d952850a9abb67f3d0175cfb38f4bb22411ade03c006d45b47fce5541e66cecba3c4c8bb3d85213486d32f0cd879eb4d

  • SSDEEP

    24576:m1JAHT4ordT2aaoHGIRmshpFPYJyRwhOO4JqY:m1mH1rdXaojpFwJy8zE1

Score
10/10
orcusdiscoveryratspywarestealer

Malware Config

Extracted

Family

orcus

C2

79.172.242.28:2404

Mutex

32fbef3c417741eda37ad5e6ba242e3d

Attributes
  • autostart_method

    Disable

  • enable_keylogger

    true

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\OrcusWatchdog.exe

Targets

    • Target

      d61d8e0cb1eb7183485f8edb5d9b4eda_JaffaCakes118

    • Size

      1.1MB

    • MD5

      d61d8e0cb1eb7183485f8edb5d9b4eda

    • SHA1

      04be3c46cffce788b7f8b8f238fa3e3296dfeb13

    • SHA256

      3eb5ab3cc11d0064fc147b145a156c1fa37e37fa9bc4e06b6789098ee4a1201d

    • SHA512

      a59e87a7a623cfa2fea7d855e9f9cb31d952850a9abb67f3d0175cfb38f4bb22411ade03c006d45b47fce5541e66cecba3c4c8bb3d85213486d32f0cd879eb4d

    • SSDEEP

      24576:m1JAHT4ordT2aaoHGIRmshpFPYJyRwhOO4JqY:m1mH1rdXaojpFwJy8zE1

    Score
    10/10
    orcusdiscoveryratspywarestealer

    • Orcus

      Orcus is a Remote Access Trojan that is being sold on underground forums.

      ratspywarestealerorcus

    • Orcurs Rat Executable

    • Drops startup file

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks