Overview

overview

10

Static

static

3

jaffacakes...kx.exe

windows10-2004-x64

10

jaffacakes...kx.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    jaffacakes118_Trojan-Spy.Win32.Orcus.kx.a76b55b0ec0595797bfdbbe999c3bd7d
  • Size 793KB
  • Sample261012-l2tc1sbe23
  • SHA256 6d73794e6ff947f692d3da10537400b8c5da017aa1c3e7213d517801375e44cc
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
orcusdiscoveryratspywarestealer

Malware Config

Extracted

Family

  • orcus

C2

  • 185.21.60.110:10134

Mutex

  • 787329db91084387aab93181796f4d35

Attributes
  • autostart_method

    Disable

  • enable_keylogger

    false

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\OrcusWatchdog.exe

Targets

    • Target
      jaffacakes118_Trojan-Spy.Win32.Orcus.kx.a76b55b0ec0595797bfdbbe999c3bd7d
    • Size 793KB
    • SHA256 6d73794e6ff947f692d3da10537400b8c5da017aa1c3e7213d517801375e44cc
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    discoveryorcusratspywarestealer

    • Family: Orcus

      Orcus is a Remote Access Trojan that is being sold on underground forums.

      ratspywarestealerorcus

    • Executes dropped EXE

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks