Extracted

• • Target

    snos.exe

  • Size

    916KB

  • MD5

    defc2abbed64bb0a53c7b9fa04d9d114

  • SHA1

    926cbb5e1d9ea1249aa034afa5d0e510322b5ee6

  • SHA256

    4a5b24522b79e54b2c901946eb492dac5bf83631681a2d99b1f6b303268e0580

  • SHA512

    00084691a0ae0c52aac630a1fca9bca0fb245ad4597c99b12016119ce289500002c6b23e47bfcd2bc220c26068615c972b8e5551b0b3dd721fd06c6387e0d842

  • SSDEEP

    24576:NVWC4MROxnFD3krXYf1rrcI0AilFEvxHPdmoo6:NqMiJtrrcI0AilFEvxHP

  Score

  10^/10

  orcusdiscoveryratspywarestealerevasion

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcus main payload

  • Orcurs Rat Executable

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops file in System32 directory

  behavioral1behavioral10behavioral11behavioral12behavioral13behavioral14behavioral15behavioral16behavioral17behavioral18behavioral2behavioral3behavioral4behavioral5behavioral6behavioral7behavioral8behavioral9