Overview

overview

10

Static

static

3

JaffaCakes...5d.exe

windows7-x64

10

JaffaCakes...5d.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    JaffaCakes118_ce6848f5380e26f63cbe3442a24bec5d

  • Size

    2.4MB

  • Sample

    250109-whs81swnd1

  • MD5

    ce6848f5380e26f63cbe3442a24bec5d

  • SHA1

    0cf7088422334e199e40de6a3b6ce82829a3d1c7

  • SHA256

    a39c8db3dbb30d641c51733ecf2febfbdefe17eec0cd1f88428fd86028eee05f

  • SHA512

    4056178b810d9879b3662805fdafec4ed1a4dd5721b4b24bc6e2f6c1ecd9b217070cea1b359469b2268608d67a1576f5bf10fa227a76989a3e4f494295129bb9

  • SSDEEP

    49152:WUZpaTotR8lX5xVzBs1iUEhdXv1s57SzyLKVFICWSWyYX3rLYFn:PaTq8PzbTXv2lKVyQeW

Score
10/10
orcuswarfaceratspywarestealer

Malware Config

Extracted

Family

orcus

Botnet

warface

C2

95.217.141.218:25565

Mutex

d9ad65394c624b9b95453d26cab4c9e1

Attributes
  • autostart_method

    TaskScheduler

  • enable_keylogger

    false

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    WindowsDefender

  • taskscheduler_taskname

    WindowsDefender

  • watchdog_path

    AppData\OrcusWatchdog.exe

Targets

    • Target

      JaffaCakes118_ce6848f5380e26f63cbe3442a24bec5d

    • Size

      2.4MB

    • MD5

      ce6848f5380e26f63cbe3442a24bec5d

    • SHA1

      0cf7088422334e199e40de6a3b6ce82829a3d1c7

    • SHA256

      a39c8db3dbb30d641c51733ecf2febfbdefe17eec0cd1f88428fd86028eee05f

    • SHA512

      4056178b810d9879b3662805fdafec4ed1a4dd5721b4b24bc6e2f6c1ecd9b217070cea1b359469b2268608d67a1576f5bf10fa227a76989a3e4f494295129bb9

    • SSDEEP

      49152:WUZpaTotR8lX5xVzBs1iUEhdXv1s57SzyLKVFICWSWyYX3rLYFn:PaTq8PzbTXv2lKVyQeW

    Score
    10/10
    orcuswarfaceratspywarestealer

    • Orcus

      Orcus is a Remote Access Trojan that is being sold on underground forums.

      ratspywarestealerorcus

    • Orcus family

      orcus

    • Orcurs Rat Executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks