Extracted

• • Target

    2f320b3ef91258433bf232bd26f5dcb9c6f70394d60680f65744a990d431c7ef

  • Size

    3.0MB

  • MD5

    b3a7960d97578ab1eb2ae60ed0c3df2e

  • SHA1

    8df3e142f4e83bfed04bc8059106f0ffa3bcd6ed

  • SHA256

    2f320b3ef91258433bf232bd26f5dcb9c6f70394d60680f65744a990d431c7ef

  • SHA512

    d429ad5165126a795d5f939198c23f048b69bda802bdb707100c49b637cd52d992027bc05186ecf269201f5a14c6d95721c0bb04f4fe2d47268e6bc749762f47

  • SSDEEP

    49152:O3X27p1EZKMnkmWg8LX5prviYDyKS5AypQxbRQAo9JnCmpEu/nRFfjI7L0qb:OWHTPJg8z1mKnypSbRxo9JCm

  Score

  10^/10

  orcusновый тегdiscoveryratspywarestealer

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcus family

    orcus

  • Orcus main payload

  • Orcurs Rat Executable

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Suspicious use of SetThreadContext

  behavioral1behavioral2