Extracted

• • Target

    9fedb52bebc89b548caf1c2d8438b88e3abe3004106f5c85595fa9ef3b952c2c

  • Size

    3.0MB

  • MD5

    c636ea3b6f9877ba652b6eff45951533

  • SHA1

    f0cb217fe930c1f55bdd64633b111785df4816c6

  • SHA256

    9fedb52bebc89b548caf1c2d8438b88e3abe3004106f5c85595fa9ef3b952c2c

  • SHA512

    b40941fb08547aa8492ce1fb98cd9ad0b51d7d527e69101fc92e7c17fa56ddb1a7503bb39eae4b0e79762edafaee1ae14db2ecbe4c5b7e3b38eace8c6674251b

  • SSDEEP

    49152:ZGX87p1EZKMnkmWg8LX5prviYDyKS5AypQxbRQAo9JnCmpKu/nRFfjI7L0qb:ZLHTPJg8z1mKnypSbRxo9JCm

  Score

  10^/10

  orcusновый тегratspywarestealer

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcus main payload

  • Orcurs Rat Executable

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2