Extracted

• • Target

    4c59be9855505c9af55d8b532031c1de313885604162eafa12d53539085df4b2

  • Size

    3.0MB

  • MD5

    e067840e2f9733e5d7bc083cc11ed4fa

  • SHA1

    4d9ad6f1c50a9eb4141a17a5af43f0e0c105b9e0

  • SHA256

    4c59be9855505c9af55d8b532031c1de313885604162eafa12d53539085df4b2

  • SHA512

    278a8da77ac55e97776239813cc9b19940dc6e99a4792a4ecdc806a4b026fe3adb1b1cf6c169545569ef54cad07abc97dd1522fcb939eae2a03a9bd1d3e7f4ec

  • SSDEEP

    49152:WVFonuvKFmwLGZeM9/dFQMDjjzKCkElU+fPONM6WAypQxb1o9JnCmwKWnzFfGI7k:W9CFmwLvEeMDjnpHfP56xypSb1o9JCm

  Score

  10^/10

  orcusconflickerevasionratspywarestealertrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • UAC bypass

    evasiontrojan

  • Orcurs Rat Executable

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Windows security modification

    evasiontrojan

  • Checks whether UAC is enabled

    evasiontrojan

  • Drops file in System32 directory

  behavioral1behavioral2