Extracted

• • Target

    945be953a3c727167f2d0bf08830062d404e28c3e61c57458a1ce91b7d97aff7

  • Size

    924KB

  • MD5

    da40621730da7f04a2b9548e1de7fb53

  • SHA1

    9bd5431b68e24146252c98a00f92da2ef00a1f31

  • SHA256

    945be953a3c727167f2d0bf08830062d404e28c3e61c57458a1ce91b7d97aff7

  • SHA512

    997ecf148b2950a51b26d8f90be80cb84a730f3a2bd7534880217f92a7916ffeb6482d70a89f0cc2f4fdda10c6ef41b69af5cb4405c96f66b0ffa3944280d5b5

  • SSDEEP

    24576:Dzra4MROxnFE3KrXpprZlI0AilFEvxHi6j:Dz1MiuQpprZlI0AilFEvxHi

  Score

  10^/10

  orcusс новым годомdiscoveryratspywarestealer

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcus family

    orcus

  • Orcus main payload

  • Orcurs Rat Executable

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  behavioral1behavioral2