Extracted

• • Target

    4ee61198bf5742ab2497f9034e73299052e4cf8d6f04ef72393f07ff8ca27dc0

  • Size

    917KB

  • MD5

    ee128fdc0c14610f0e94610332c8f189

  • SHA1

    d29af3db2e278549e22fa7b8bd939b581b34150c

  • SHA256

    4ee61198bf5742ab2497f9034e73299052e4cf8d6f04ef72393f07ff8ca27dc0

  • SHA512

    884fd9316c51a91c2fba4222bfed7a4667fffc056715cda7591d49ab26e2c161365451123b667ab6fe4a1269b139aeba6f02ee460173fda7b8cee8e10918e9fd

  • SSDEEP

    24576:2CC4MROxnFi33snrrcI0AilFEvxHPDooW:2KMiocnrrcI0AilFEvxHP

  Score

  10^/10

  orcuspersistenceratspywarestealer

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcus main payload

  • Orcurs Rat Executable

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2