Extracted

• • Target

    7a7daa96cfb24335bd6dc0e929743bc84b5d1789e044ffbe3ebb01b08ccf2d4c

  • Size

    15.0MB

  • MD5

    c9a729181d000d53b390da89f4d68d0c

  • SHA1

    b1ba9b1e69634202f596c31bd69d975f3ddf5298

  • SHA256

    7a7daa96cfb24335bd6dc0e929743bc84b5d1789e044ffbe3ebb01b08ccf2d4c

  • SHA512

    04bb394e0695220a3436493fad6ad6cc531a63d0533c073216e919502dea8b7475575fb84fe1bf28954f62357ea6d1f1c1cf4e7f5e1b4eedafaa5365a60cd46a

  • SSDEEP

    24576:1Zf4MROxnFaarrcI0AilFEvxHPG+qoot:1WMi5rrcI0AilFEvxHP

  Score

  10^/10

  orcusccratspywarestealer

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcus main payload

  • Orcurs Rat Executable

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops file in System32 directory

  behavioral1behavioral2