Extracted

• • Target

    JaffaCakes118_eacf04d721fe4880dc73790ccbd58acf310dc0c90b13b7424200a9aa2b94640a

  • Size

    926.0MB

  • MD5

    930b3bbbaa989db448d8ec5c696a5a16

  • SHA1

    a27e7c76990a31f1414d429e828c81e14f48a00a

  • SHA256

    eacf04d721fe4880dc73790ccbd58acf310dc0c90b13b7424200a9aa2b94640a

  • SHA512

    cb9dc7db9f4a4c0dc5407d0a9bbd5c1301d5c4d03fed7d6b972c61a816c8860aff072f1515189d21b3336448a7c19d99f636cc3b060e4628c2ef7dbd1e75291a

  • SSDEEP

    49152:KUAHP06/eyShf+okdWtRAOk3HQ7JTDCgV4L6uzxGiWaUKU:WmBf2dWtnGcDnMjFWxK

  Score

  10^/10

  orcusagilenetdiscoveryexecutionpersistenceratspywarestealer

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcus family

    orcus

  • Orcus main payload

  • Orcurs Rat Executable

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Obfuscated with Agile.Net obfuscator

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  behavioral1behavioral2