Extracted

• • Target

    a96fb9f82e3e9c69d5e101f23d2f53899c2ac8d8fcb4ae638f1fe0225aee3b6e

  • Size

    924KB

  • MD5

    df4d4c4eee0bb233905ef88daca5e3e0

  • SHA1

    4c9c17b1c2e1654c7da04a3674f02cc15502b550

  • SHA256

    a96fb9f82e3e9c69d5e101f23d2f53899c2ac8d8fcb4ae638f1fe0225aee3b6e

  • SHA512

    63517b87374cc0e3cf5a20ce2e64e44355bc88cb5a9688127dcd7285b1092b46362495272274513ec33d16ab17d050f1f8ff988ad431c662ed0e315abadddc0d

  • SSDEEP

    24576:Yzra4MROxnFE3KrXpmrZlI0AilFEvxHinj:Yz1MiuQpmrZlI0AilFEvxHi

  Score

  10^/10

  orcusratspywarestealer

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcus main payload

  • Orcurs Rat Executable

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  behavioral1behavioral2