Extracted

• • Target

    84219374f172ea99bebe9fd7dc98710725d4db38949cf1031acb13e135f0d530

  • Size

    940KB

  • MD5

    349136bb636b9cfb47d8933041cf72c1

  • SHA1

    eddfa1e216a0a72333b0ce79046d72f010063af8

  • SHA256

    84219374f172ea99bebe9fd7dc98710725d4db38949cf1031acb13e135f0d530

  • SHA512

    b0f7ba45275b40a42e74bdc684b74409f444f4ff9a63e2f63000ed4b1f6aad1f432bc60f5e69e739db7c44718499d2c263e834c25f6cf852e8a94659a5dc1953

  • SSDEEP

    24576:vsz3s4MROxnF9LqrZlI0AilFEvxHi8b8om:0z3/Mi7qrZlI0AilFEvxHi7

  Score

  10^/10

  orcusdiscoveryratspywarestealer

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcus family

    orcus

  • Orcus main payload

  • Orcurs Rat Executable

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  behavioral1behavioral2