Extracted

• • Target

    1895ea7718500dfd7ddf4ccbf5057816fc06f849e72e644ba72c57f6241ca860

  • Size

    3.0MB

  • MD5

    5061282fe58821440585f7bbb1708423

  • SHA1

    f64e5554bd39d34f872f9e74bef2b6bdcdb5541d

  • SHA256

    1895ea7718500dfd7ddf4ccbf5057816fc06f849e72e644ba72c57f6241ca860

  • SHA512

    3ad7f99cba8fded3c1be9c3ee3611308915eedaea18ec9c02b7ef245d2cd4bb7caab8cb15f50db00f64eb4c6c2ac180feeb7fc5d4f91caab0943c2e1fbb3d61d

  • SSDEEP

    49152:Y02N8QFUwqYZeM9/ZzzBjMkPUayX82+YXAypQxb9ndo9JnCmFWncFf0I74gu3tM:Yd0wGGzBjryX82uypSb9ndo9JCm

  Score

  10^/10

  orcuspersistenceratspywarestealer

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcus family

    orcus

  • Orcurs Rat Executable

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2