Extracted

• • Target

    1b19c6662d0ccd72f6b8abca39b6e6abfcd3d4ad874042247deec002eda7f421

  • Size

    912KB

  • MD5

    ed773203c47d0ab65d0a6bafd4f56f0c

  • SHA1

    11578290084ce2bc4377948ec626cdd119176bbb

  • SHA256

    1b19c6662d0ccd72f6b8abca39b6e6abfcd3d4ad874042247deec002eda7f421

  • SHA512

    cb1338dade558a387a4b2a0de06bf93c90b163dae32f629be64e175157b06f0f4800d0f6f056f2ac9fb4aa688fd9d80a6aecf006359c7f1fbc2a887d5657417f

  • SSDEEP

    24576:nam4MROxnFrFPurerrcI0AilFEvxHPWoop:nOMiMerrcI0AilFEvxHP

  Score

  10^/10

  orcusclientratspywarestealer

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcurs Rat Executable

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2