Extracted

• • Target

    1956912c7435170065dafe572669976d_JaffaCakes118

  • Size

    903KB

  • MD5

    1956912c7435170065dafe572669976d

  • SHA1

    6bedf6357a60dd1b0884b2d8f4b272e707f58059

  • SHA256

    d35166f066d2879609c5505a9c6069a11e9005053dde8659ee00a1cd705c7c8a

  • SHA512

    744ed26178e0e6d24f6d28c958cef65819ceed496a2e0089c94883ac1f57abcca51852c9105520cb303a6cb7881844ce73143b92d0754dea72e92b6f34d821ef

  • SSDEEP

    12288:z0XCGPSX0zbyD+ndg+QCImGYUl9qyzlkE2kUNCBfm9rR6W7BaepBwzo7dG1lFlWQ:Qam4MROxnF4HrrcI0AilFEvxHP1uoo1

  Score

  10^/10

  orcusdiscoveryratspywarestealer

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcus main payload

  • Orcurs Rat Executable

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2