Extracted

• • Target

    25704a9ffe807caab1b7f0800f22692f.exe

  • Size

    981KB

  • MD5

    25704a9ffe807caab1b7f0800f22692f

  • SHA1

    61c2c9d62e14410a079746ab6c3272e3ba1e926d

  • SHA256

    bb878d54b68e3be71f2e61cd0e3a8f554a401b49204f76332fad3f8d4960f668

  • SHA512

    70fa6a3551573fac4b1a2852a7bb679c2a641ff62a7a597a5978984a61e8d7e467335e5b31c21d17ea76b855574baaaaa4b11417d42c7529bd757ccc693b6656

  • SSDEEP

    12288:fn4noCPJgCmEAK/frrzBmx7ByirqLVnU93t8dLB0w9LAhDHzqO4tq9q/47QrcSNw:fn4JPRnDJmx8UUVnUpil9LAf4tWoP

  Score

  10^/10

  orcusratspywarestealer

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcurs Rat Executable

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  behavioral1