Extracted

• • Target

    4346e01001903432c6da8a05fa653030081379a9d4c648b22cdd318b5b165788

  • Size

    5.0MB

  • MD5

    f1ba7a7f631a21d3c5967dcabd56864f

  • SHA1

    098faa39a5eeeaad11b73ccf51b4bae6e9ab88bc

  • SHA256

    4346e01001903432c6da8a05fa653030081379a9d4c648b22cdd318b5b165788

  • SHA512

    c764b7bc0646fdbe1ae3687a0f08dad7bc724e308c7cd7fb993f7933686cef8b4b9c2be1248061d36733ac3224e3e003edb59736a783bc2f6e59ddc51fbd2bb6

  • SSDEEP

    12288:s0XCGPSX0zbyD+ndg+QCImGYUl9qyzlkE2kUNC7JsLdn48F1IepdkRI7dG1lFlWQ:nIY4MROxnFtMrrcI0AilFEvxHP6Xoon

  Score

  10^/10

  orcusratspywarestealer

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcus main payload

  • Orcurs Rat Executable

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  behavioral1behavioral2