Extracted

• • Target

    9c5fedc85ab7bbaa7c97f3bd55f6b035ceee3b8a74f1a57ab752a00ff6f4d50e

  • Size

    3.7MB

  • MD5

    caaa8fec9e2569e494b423653772ccb4

  • SHA1

    c3822270ee1ed555e0cbc5351b9c44ba8e6ba5bb

  • SHA256

    9c5fedc85ab7bbaa7c97f3bd55f6b035ceee3b8a74f1a57ab752a00ff6f4d50e

  • SHA512

    fb2afc7647aaf2b620c7bc4e195114d4de2e6e46ee2faca9e3d9820fe6e91b3f5fb2282826305380a82da260c0ccd8207a6611936fc5cd29bd13d675a9f02869

  • SSDEEP

    49152:vE36D/TG+N8QFUwqYZeM9/ZzzBjMkPUayX82+YXAypQxb9ndo9JnCmTWncFf0I7e:vNbb0wGGzBjryX82uypSb9ndo9JCmU

  Score

  10^/10

  orcusdiscoverypersistenceratspywarestealer

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcus family

    orcus

  • Orcurs Rat Executable

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops file in System32 directory

  behavioral1behavioral2