Extracted

• • Target

    https://cdn.discordapp.com/attachments/1304516917402406973/1304865951333744660/Titan.exe?ex=6730f29e&is=672fa11e&hm=c1b5ef9ec4e79a61ea45e3502e24db35642c724e514e0cd8ac809180ca7b30ff&

  Score

  10^/10

  orcusnurikdiscoveryexecutionratspywarestealer

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcus family

    orcus

  • Orcus main payload

  • Orcurs Rat Executable

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Legitimate hosting services abused for malware hosting/C2

  • Suspicious use of SetThreadContext

  behavioral1behavioral2behavioral3