Overview

overview

10

Static

static

3

jaffacakes...np.exe

windows10-2004-x64

7

jaffacakes...np.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    jaffacakes118_Trojan-Spy.Win32.Orcus.np.55ae3963d3d9111647f466e72505f09a
  • Size 989KB
  • Sample261012-l2v7lsbe27
  • SHA256 86380652b8f44fe7d217722a06a41c68ae19fe3311780a76b9a0cfe1c29f999b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
orcusdiamond1discoverypersistenceprivilege_escalationratspywarestealer

Malware Config

Extracted

Family

  • orcus

Botnet

  • diamond1

C2

  • wh1t3h0rs3.duckdns.org:7007

Mutex

  • 3fc98dbce316461fb6dd94bf608d1058

Attributes
  • autostart_method

    Disable

  • enable_keylogger

    true

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\OrcusWatchdog.exe

Targets

    • Target
      jaffacakes118_Trojan-Spy.Win32.Orcus.np.55ae3963d3d9111647f466e72505f09a
    • Size 989KB
    • SHA256 86380652b8f44fe7d217722a06a41c68ae19fe3311780a76b9a0cfe1c29f999b
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    discoverypersistenceprivilege_escalationdiamond1orcusratspywarestealer

    • Family: Orcus

      Orcus is a Remote Access Trojan that is being sold on underground forums.

      ratspywarestealerorcus

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Creates a file in the Startup directory

      A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

      persistenceprivilege_escalation

    • Executes dropped EXE

    • Drops desktop.ini file(s)

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks