Extracted

• • Target

    qwerqwer.exe

  • Size

    918KB

  • MD5

    99702a2ec0da1a118d07e1520f2d3d07

  • SHA1

    03665d4bed23292fbb345bfe66cc4098f97e653a

  • SHA256

    4ac27d468230487e3f44345c54be916fe26b417c2c5ec1e745261ab83b327d09

  • SHA512

    46b5502f4b76b202ef4add1c6732467ef60a6f30fc2213b6073caee46029494481c392885b9dd5abef261a2fb8ad362a4ceb5bdcc13c55e8e62db5e3ef91e155

  • SSDEEP

    12288:u0XCGPSX0zbyD+ndg+QCImGYUl9qyzlkE2kUNCg+34ai5V2Xopqi1n07dG1lFlWk:s2C4MROxnF9brrcI0AilFEvxHjDxQu

  Score

  10^/10

  orcuspersistenceransomwareratspywarestealer

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcus main payload

  • Orcurs Rat Executable

  • Drops file in Drivers directory

  • Executes dropped EXE

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Sets desktop wallpaper using registry

    ransomware
  behavioral1