Overview

overview

10

Static

static

5

jaffacakes...ck.exe

windows10-2004-x64

10

jaffacakes...ck.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    jaffacakes118_Trojan-Spy.Win32.Zbot.zmck.da64748396351cac1326bd221c23e332
  • Size 1.8MB
  • Sample261016-dlynsswtfy
  • SHA256 1b3509ff1e1950bb97d58447c4906ddeebf201ef194297279329a8ee8689db14
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
orcusdiscoveryratspywarestealer

Malware Config

Extracted

Family

  • orcus

C2

  • 185.208.211.22:21335

Mutex

  • b7128d365a2148fd8a303179df4ff010

Attributes
  • autostart_method

    Disable

  • enable_keylogger

    true

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\OrcusWatchdog.exe

Targets

    • Target
      jaffacakes118_Trojan-Spy.Win32.Zbot.zmck.da64748396351cac1326bd221c23e332
    • Size 1.8MB
    • SHA256 1b3509ff1e1950bb97d58447c4906ddeebf201ef194297279329a8ee8689db14
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    discoveryorcusratspywarestealer

    • Family: Orcus

      Orcus is a Remote Access Trojan that is being sold on underground forums.

      ratspywarestealerorcus

    • Drops desktop.ini file(s)

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks