Extracted

• • Target

    5d816fa5fb0796094c69484cd7fb9690fa50ff32591de7521a05f66d0066ee4d.exe

  • Size

    1.2MB

  • MD5

    8ab48c46fae7d005aa5f3a058d567517

  • SHA1

    6a1acf1f9d78c295e98903cc60b6eb72f818c487

  • SHA256

    5d816fa5fb0796094c69484cd7fb9690fa50ff32591de7521a05f66d0066ee4d

  • SHA512

    d477529724f2fd26a5fe1c7406c32009f8661ae28b0ff4cf0598cd2975ee243389963b34a499d5f510a4e641cabdfb8f17c9a434d757cd31573e6efd7a66c002

  • SSDEEP

    24576:rwVTXJvatkjAE+k/7aygMpbUdtoQVj020iDqxJooLUcdJYRkH:KTQujL+hMyhVj8y8J7UcGm

  Score

  10^/10

  orcuscutiesdiscoveryexecutionratspywarestealer

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcus family

    orcus

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Suspicious use of SetThreadContext

  behavioral1behavioral2