Extracted

• • Target

    488e864dbf450b583fd0507ca184948db58e7cfafde95795a1d7546b472d6674

  • Size

    1.0MB

  • MD5

    9640302636336bc3d306f51dc67d37c6

  • SHA1

    5af7e540340e6625c8ce4a70b86c106944396990

  • SHA256

    488e864dbf450b583fd0507ca184948db58e7cfafde95795a1d7546b472d6674

  • SHA512

    e0b52ae370c3dc02fce74a2b9d0fe2f9403f92b128ec6e4e552b21792c026cbc91a4070f14235f9a972bc5f65d8782873e99174f773c835ce9db6ca664a44484

  • SSDEEP

    24576:VVj4MROxnFf3AumXrrcI0AilFEvxHPxoow:VyMidgrrcI0AilFEvxHP

  Score

  10^/10

  orcusadminpersistenceratspywarestealer

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcus main payload

  • Orcurs Rat Executable

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2