Extracted

• • Target

    1f2082894179434f7f9180d3cf553d056755df6af57f6117bd3237486c6478db

  • Size

    1.2MB

  • MD5

    2a03b08eba89b4d692752ee2501a3cd1

  • SHA1

    0cf46736c4c12373645950f3942d73e853e3787b

  • SHA256

    1f2082894179434f7f9180d3cf553d056755df6af57f6117bd3237486c6478db

  • SHA512

    c94eff8f0d84fd7216771c90e1666cd69ad469d9749547dbe49dd641f3c52e4ebf42856d225743f2f95b589fb98437975cc553754f6b8f37460b16b18c7bffc0

  • SSDEEP

    24576:rsS04YNEMuExDiU6E5R9s8xY/2l/d0J5dtsPxNGf52Ibt+ra:rE4auS+UjfU2Tg5XDB2Ibt+r

  Score

  10^/10

  orcusdiscoveryratspywarestealeradwarepersistenceprivilege_escalation

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcus family

    orcus

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Drops desktop.ini file(s)

  • Installs/modifies Browser Helper Object

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware

  • Drops file in System32 directory

  behavioral1behavioral2