Extracted

• • Target

    e968a999d84485fbbabfad9c699aabb7e1385ef87233791af45640ee503b1977

  • Size

    3.0MB

  • MD5

    964641b162701d1d9ec7536e17728587

  • SHA1

    5658bed6493fe944cb966a49b3a1ac116acdea1d

  • SHA256

    e968a999d84485fbbabfad9c699aabb7e1385ef87233791af45640ee503b1977

  • SHA512

    0b9eb75d0db24f4d43e3397d9c4eba6259919b7f67ccc9a6e029718ecc5ab8ff0c5b561e516918cb00bceded1ed73a7734776a74ef885bc1badffa4fea31ed65

  • SSDEEP

    49152:7AkDf7+QSLqZeM9/04zgaMWUljQfJgVXkKAypQxb0/o9JnCmEWncFf0I74gu3sM:7Pyb2MnjQBEUNypSb6o9JCm

  Score

  10^/10

  orcusratspywarestealer

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcurs Rat Executable

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  behavioral1behavioral2