Extracted

• • Target

    a863bd17dfbc29c69ff0246665604bd99811b63cd2fd22bfd97c2c7715218e77

  • Size

    3.2MB

  • MD5

    ba673cd29119974eba5c7a7173480e89

  • SHA1

    12c7db1b85f2e422faa28dd802a42470ce33bb8d

  • SHA256

    a863bd17dfbc29c69ff0246665604bd99811b63cd2fd22bfd97c2c7715218e77

  • SHA512

    e2d2ae4db1ed50a0aa8f8183454fede7a915b8d0c6f19fbc51e851c53fbd850880d7a350915825c29f5a619da4d8bfd2b9b8eef47ef14e3306097a101e475d47

  • SSDEEP

    49152:EoWN8QFUwqYZeM9/ZzzBjMkPUayX82+YXAypQxb9ndo9JnCmGWncFf0I74gu3vMv:Ep0wGGzBjryX82uypSb9ndo9JCmc

  Score

  10^/10

  orcuspersistenceratspywarestealer

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcurs Rat Executable

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2