Extracted

• • Target

    3b1e335dac241e714b475cfeb2b5568c39dbd3fd660c8e2baded23e84246e8a1

  • Size

    923KB

  • MD5

    90aad458c97b7381972efdfb0b02c57e

  • SHA1

    069220f73ef14d30816612450549ccd1faaca135

  • SHA256

    3b1e335dac241e714b475cfeb2b5568c39dbd3fd660c8e2baded23e84246e8a1

  • SHA512

    d6858685120dffac208cb8b7b90be0a3ade20984a9a4fb372ab4515f0f9fd57f52aabc630d272200294e35143bda3cfbb8b722c03852ea170493943c72ac1714

  • SSDEEP

    12288:WipkuIqoE8Byn6497dG1lFlWcYT70pxnnaaoawGRVcTqSA+9rZNrI0AilFEvxHvd:6mV4MROxnFPLqrZlI0AilFEvxHiZ7u

  Score

  10^/10

  orcuspersistenceratspywarestealer

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcus main payload

  • Orcurs Rat Executable

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  behavioral1behavioral2