Extracted

• • Target

    2c49c82f684c4d5de26627294556ed5e_JaffaCakes118

  • Size

    1.7MB

  • MD5

    2c49c82f684c4d5de26627294556ed5e

  • SHA1

    3df81bf27d88964c7f56d13b6a11e6f2873d065b

  • SHA256

    acccfc2189e8bde1e7566f15bb9b3b0e562570eabb893cac966c297b65c19364

  • SHA512

    950cc7c39b25ea874c9412445459442ac4a9d63fd0578c2a9cc9fd81b74d40d7439f5c304cbb4ee5b91c009f690159dd7947a7a5fcc7aa910bd3b2920cf07419

  • SSDEEP

    49152:Ur9gNGKXYe/AhPAyTJwbfxlycZ1A5wR/LKbPD1+:UBMd8ub7ycZ1b+b

  Score

  10^/10

  orcusfudservpersistenceratspywarestealerupx

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcurs Rat Executable

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Executes dropped EXE

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx

  • Adds Run key to start application

    persistence

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  behavioral1behavioral2