Extracted

• • Target

    87f7d55dbf9bd13dd5440ef0a51fec2e_JaffaCakes118

  • Size

    2.3MB

  • MD5

    87f7d55dbf9bd13dd5440ef0a51fec2e

  • SHA1

    b57facd3bda38c5fca68a44898cc7930d727e48c

  • SHA256

    098c48ea4fb2c2f4efefba74a6e4c3c4c0367ed8a257786fcf3cc9d9d08f8377

  • SHA512

    b887e2b340a22a0a6607ef5396bb5d75ac68c6a7d06e0def3fbaa86fb59696c89399b6b83a870f7fb88f5804e055ce8f873d811d2b58ff6471e700c6bc3d1659

  • SSDEEP

    49152:3AyKUOPuD8C+N+3M/i5cdRW2CVip0CfXl2LXV7eoW:bh8YNcdRW2KiRgF5W

  Score

  10^/10

  orcusdefense_evasiondiscoverypersistenceratspywarestealer

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcus main payload

  • Orcurs Rat Executable

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Enumerates processes with tasklist

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2