Extracted

• • Target

    57e85409564bed14d33d2ae2663b2bc64f99588c83b208f9091eceaf87097c1b

  • Size

    100KB

  • MD5

    b7756f9d9e8c5f4ba2c930adb666fbae

  • SHA1

    8ddb9f2a559f6af5ccaa04c8b5b589d216357340

  • SHA256

    57e85409564bed14d33d2ae2663b2bc64f99588c83b208f9091eceaf87097c1b

  • SHA512

    c5c85c86251c34530b672de0feee38bd148cddd53beb7191a250f09e6d504460c343a0f608e2002434e4b98585e61222f44bc159bfb2a340c0e73a3941bef67f

  • SSDEEP

    1536:DQIAibOVOk3udovOyePC9Eop2h90L64QG9iDCzPgQD8Kg90a//MudDBG:DQ/ibOcIudovOy8CUwIOkCzgQq0UzxM

  Score

  10^/10

  orcusplaguebotbotnetevasionpersistenceratspywarestealertrojan

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Modifies security service

    evasion

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcus main payload

  • PlagueBot

    PlagueBot is an open source Bot written in Pascal.

    botnetplaguebot

  • Orcurs Rat Executable

  • PlagueBot Executable

  • Blocklisted process makes network request

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  behavioral1