Extracted

• • Target

    eb8983bd4a3c5bdeb19b56b6dc13c880faee195338f276b885c69d9b885a22b5

  • Size

    3.0MB

  • MD5

    ab991807e803c94d2466505fc3f0715f

  • SHA1

    5f9b2c10080bab7a67f83d7c9c2a96388b25463e

  • SHA256

    eb8983bd4a3c5bdeb19b56b6dc13c880faee195338f276b885c69d9b885a22b5

  • SHA512

    b6a649493f12f348b6604fba90fa69b37e8d9a9b241d167753eaae8f1f6f7a69a182d47685f9c0e9091fbbb5eb3ebbe5544b204bd5ebda9551db6c6dd2a5dc79

  • SSDEEP

    49152:1GX87p1EZKMnkmWg8LX5prviYDyKS5AypQxbRQAo9JnCmpKu/nRFfjI7L0qb:1LHTPJg8z1mKnypSbRxo9JCm

  Score

  10^/10

  orcusновый тегratspywarestealer

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcus main payload

  • Orcurs Rat Executable

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious use of SetThreadContext

  behavioral1behavioral2