Extracted

• • Target

    InfectedOrcusexe_JC.exe

  • Size

    924KB

  • MD5

    50934b67c750b799ab289ed81cd3541e

  • SHA1

    5a34ca843c0519709c6a1a225d091fb8e6641634

  • SHA256

    ada48bfc6a0afe43c1f996289e8353f77d82e7b42e280b7feea7664a4beef2e3

  • SHA512

    4e43b9e5b3a235b59af02299ba231ef9ad7787ce3858ea6ccf8b864cdf1357c540f02cfba53cc9bbea581320d7a1810f3905df6384663d419ccb3a1cf35c198d

  • SSDEEP

    24576:fCC4MROxnFE3bO3YrrcI0AilFEvxHPaQoow:fKMiuoYrrcI0AilFEvxHPa

  Score

  10^/10

  orcusmamontpersistenceratspywarestealer

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcus main payload

  • Orcurs Rat Executable

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2