Extracted

• • Target

    a1ec8b5553c1d4a8608cc48bdcdbfee3_JaffaCakes118

  • Size

    4.0MB

  • MD5

    a1ec8b5553c1d4a8608cc48bdcdbfee3

  • SHA1

    7518b6aeedf0c08b4657d35c2e7ae40db4ca56e8

  • SHA256

    b3f6aea2a38444bce16dca8a8ee5e8e34bfac373f265d9fba48ae9cc8e98d509

  • SHA512

    86ba03e934d5c4a625cf75cd85450227c7360e326b9478629cb2d6c570ba8746ee818446a85d4c163ae331440adca9103d52fff68b18669794c2f48079d68aef

  • SSDEEP

    98304:+viz/27qWGq/TzuqCDl2Ptao7jpMM9uDvb45NytprUNi:+viq75/TzufVjf0cGNi

  Score

  10^/10

  orcusklaietdiscoverypersistenceratspywarestealer

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcus main payload

  • Orcurs Rat Executable

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  behavioral1behavioral2