Extracted

• • Target

    eee2282277e64485627c058793aa65e0_JaffaCakes118

  • Size

    1009KB

  • MD5

    eee2282277e64485627c058793aa65e0

  • SHA1

    ed5ae121bf074decf9b7a95214e67874733a5cf2

  • SHA256

    79e31aa291777d936bdbd198ebf53f3b7d230972fcf95f92908872aca6bf888c

  • SHA512

    b5ea27c4b0e14687065c94b72fa3c177fe161a92c15aad7db48a466ea34745fbfd15d7305f022ef322f41169b81df621253ace5d0720d11eb8ccc688a251767b

  • SSDEEP

    24576:74bcdQ5WxQtrU7yHt08EAmAKywxqmJiJW3M1T+:7fdC9WmLF/mcwM1

  Score

  10^/10

  orcusdefense_evasiondiscoveryratspywarestealer

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcus main payload

  • Orcurs Rat Executable

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2