Extracted

• • Target

    yef.exe.bin

  • Size

    1.2MB

  • MD5

    58991bbcf8a974e128ba64f3bcb31e6e

  • SHA1

    645a5096283c1f0b63ff07f3927534e44804114d

  • SHA256

    d05f328df78420b8d97cb7205cccee30617ebeff333ac8d5ed32f6da69563baa

  • SHA512

    76c35a2b6b787ded9c049b189b8844019720f47c0f2e07ced1c9b9b7622382d50062770f222ad1a0a626e66498be3d3e6cc22ca9c7fbf72d3b29b7f59e881eb6

  • SSDEEP

    24576:rwVTXJvatkjAE+k/7aygMpbUdtoQVj020iDqxJooLUcdJYRk:KTQujL+hMyhVj8y8J7UcG

  Score

  10^/10

  orcuscutiesdiscoveryexecutionratspywarestealer

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcus family

    orcus

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2