Extracted

• • Target

    138b682d76b3ec1a4a84406c3f6a0ee2da29bec0ae6feb6c05f7b6c8eb98b96f

  • Size

    845KB

  • MD5

    87763ae22a66ea3276fe9b14d65725ea

  • SHA1

    908228d0bba0351a4c4bf25ab4ae2b41ed520f7d

  • SHA256

    138b682d76b3ec1a4a84406c3f6a0ee2da29bec0ae6feb6c05f7b6c8eb98b96f

  • SHA512

    fdf7ba8ebc84b8cb9e3fdaf34d5c035d3456cdc671a6cf0ea1774dc73f4931d95fcdbf25605991028f5236097af6484e2aa9679baf580c15ea982e14f31f30e4

  • SSDEEP

    24576:FvS04YNEMuExDiU6E5R9s8xY/2l/dHzIbt+ra:FF4auS+UjfU2THzIbt+r

  Score

  10^/10

  orcusdiscoveryratspywarestealer

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcus family

    orcus

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Drops desktop.ini file(s)

  • Legitimate hosting services abused for malware hosting/C2

  behavioral1behavioral2