Extracted

• • Target

    6e8d85f01f1162a214619e5fff7c0770N.exe

  • Size

    920KB

  • MD5

    6e8d85f01f1162a214619e5fff7c0770

  • SHA1

    2e12ef483caaa2ad6f25fdbcbbf9e26791560c43

  • SHA256

    da27775617ea9a84d46876fd71de1a548e5d3b0e1b505cab270afb250b596fbe

  • SHA512

    b1cd53ddd4a33349f511f007f3ef233a6ad093f27147e56adfa669120e9d793272946211fecb41f2ca335bb908b92e576059947d77fed663d8690dd85d4756d5

  • SSDEEP

    24576:OpP4MROxnFt3rmrrcI0AilFEvxHPR7ooC:O2MijarrcI0AilFEvxHP

  Score

  10^/10

  orcusv0.4discoveryratspywarestealer

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcus main payload

  • Orcurs Rat Executable

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral2