Extracted

• • Target

    a9aa350b786356d7d78279e338ccc590N.exe

  • Size

    7.6MB

  • MD5

    a9aa350b786356d7d78279e338ccc590

  • SHA1

    248541c0cac6a66ba81dd8573470a15fd6107ddd

  • SHA256

    1a740ea5fc256aeac6c2df54d489e502cd2b752c20c09495ff879705f4bf5a0c

  • SHA512

    c7c4f3412ec0e027f5230b9912a1c2885c075cfc3cd5836ee21be44a93bf81df9afad7dda12274a29e5607f50a1ddb3290462170098dd53b731a4582d8890ef1

  • SSDEEP

    196608:0N/rsm+cw4nWA4e9p9KGOXvFzYJncZfN/rsm+cw9nWA4e9p9KGOXvFzYJncZwh:0N/rsr4nC0PodYJncpN/rsr9nC0PodYt

  Score

  10^/10

  orcusdiscoveryevasionmacropersistenceratspywarestealerthemidatrojan

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcus main payload

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    evasion

  • Orcurs Rat Executable

  • Suspicious Office macro

    Office document equipped with macros.

    macro

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Themida packer

    Detects Themida, an advanced Windows software protection system.

    themida

  • Adds Run key to start application

    persistence

  • Checks whether UAC is enabled

    evasiontrojan

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2