Extracted

• • Target

    eb96f321bac830019d44e74dc71e7d5e_JaffaCakes118

  • Size

    1.7MB

  • MD5

    eb96f321bac830019d44e74dc71e7d5e

  • SHA1

    48d014342efb6ac62408333906c9a0febc449272

  • SHA256

    3ba4240f334de3b93655a053fc2574c0228757a9948354d3e97637ab36be7700

  • SHA512

    37d902242963c493cb339ebed5cef0f1fc3e75499b648ac81c98447c595946fe1e7530e4f58f0d1b07c268c0ae9c0f333488dc3db4f865b166f9c5a5601ccbd5

  • SSDEEP

    24576:qZDcFJfUEv5WQv6CxfyWevTneaypwvYXtKjvhykq4ejRgRpdtCF9Q3fdeXWAM1G0:qGFJVWQvv6TnQqeyhyDG2Q3fss1GHL

  Score

  10^/10

  orcusratspywarestealer

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcurs Rat Executable

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2