Extracted

• • Target

    f7a46b53afa7814e739d59fcdbd527fc_JaffaCakes118

  • Size

    2.8MB

  • MD5

    f7a46b53afa7814e739d59fcdbd527fc

  • SHA1

    b1d3158156a63d3981c3d49c33bb94ef899611d6

  • SHA256

    c4d9d25dedcb02acf6eae98dec3fae4e53585ef8486d755f2b77740dd7ba7797

  • SHA512

    0bb5d13d55fd27f1feb8c055118ba43fa0a611a2512abafbaceba0d2d3c0e5e9a45520d2f8093070589df422721f568fcc6b59fc2c994288ab5d2ec898b6b5da

  • SSDEEP

    49152:Kkqgee3wKnRhpv83eiLG36HlHVQZTpzRcxen5+saw9FF9+4eIDTeWY5g:LeegihkpzHlHoFRcgn/B3P+eeW

  Score

  10^/10

  orcuscredential_accessdefense_evasiondiscoveryratspywarestealer

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcus main payload

  • Orcurs Rat Executable

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Suspicious use of SetThreadContext

  behavioral1behavioral2