Extracted

• • Target

    7a8cc9b41ba327d6976bb2dd20ea359d_JaffaCakes118

  • Size

    1.3MB

  • MD5

    7a8cc9b41ba327d6976bb2dd20ea359d

  • SHA1

    bb495b2ae6ce62e7135f41bc2b0b2701d848b065

  • SHA256

    4fb1076d44a48a380eb03a63a5085db0c1cf902fdb436731183f4f26df89c90b

  • SHA512

    f7c1cef9a5bf55e5f3b2c5e69f61869cb2f568d43aed47953062174836a23757c62c98b9efd4c265560f1be5f8b0ccc51905d381d912f3ab50d7a35790bbf6ba

  • SSDEEP

    24576:skIHiol2Lx7arZgWgGhxKKOiiPmA/GYAAFqBj19+:8ivLx7cyW6iQL9A3Q

  Score

  10^/10

  orcusdesk021320persistenceratspywarestealer

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcurs Rat Executable

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application

    persistence

  • Suspicious use of SetThreadContext

  behavioral1behavioral2