Extracted

• • Target

    08ceb7c414a1389d1c84acebf18e05aca59e2b3c732dd117685d77bda2be3a10

  • Size

    3.0MB

  • MD5

    7fc313209a40c3da1f080de07765b01d

  • SHA1

    fdb724f810d7653773756990b5eb96b49c825308

  • SHA256

    08ceb7c414a1389d1c84acebf18e05aca59e2b3c732dd117685d77bda2be3a10

  • SHA512

    6c7f6ab5526c411869a37de025e0bd9a614d2da72167b2a2094165fe866c23c4e19780ee3cf916727c840029e67fa38958d5cd79fc8c31e8ae75faf0802b07ee

  • SSDEEP

    49152:O3X27p1EZKMnkmWg8LX5prviYDyKS5AypQxbRQAo9JnCmpEu/nRFfjI7L0qbe:OWHTPJg8z1mKnypSbRxo9JCm

  Score

  10^/10

  orcusновый тегratspywarestealer

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcus main payload

  • Orcurs Rat Executable

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2