Extracted

• • Target

    OrcusRAT.exe

  • Size

    16.3MB

  • MD5

    bec4a5b0b6db81ce39d6f2e3721911e3

  • SHA1

    4d5cff870c8012f0978ecb6d4a579dc84a4f2ad3

  • SHA256

    9b52478f24a02f622d71fc14c484e03dd240f0ac0b9166e0b58defa0edfc0404

  • SHA512

    8990173964cd8ff719ac3f524e0ba6c5a99c815ecf6549cf67b126e7d581b8a2a8bc1432fc7d844f5e4b590b3554ee320370968be3fc5b7c623d3e8b29d8b1c6

  • SSDEEP

    196608:CI6JYPVMxrZbapOU4SxTtn52dQ2CIierfBrec1CoHktdsXNPIawd4D3jtg4neJx0:C9JYaxrckZxQ2I431HHiWE63ju4en

  Score

  10^/10

  orcusxwormdiscoveryexecutionpersistenceratspywarestealertrojan

  • Detect Xworm Payload

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcus family

    orcus

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Orcurs Rat Executable

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral1behavioral2