Extracted

• • Target

    RamBoost.exe

  • Size

    11.1MB

  • MD5

    a5c93db4c83dab084d6d4ae80ce1e527

  • SHA1

    e90866ae65781058b98cb155e35b7ce1445d6139

  • SHA256

    d9dc36b7bedf2632fe0a7ca99478b20406d288a69bd7b65e5da2c9d748a5b81f

  • SHA512

    e61fdcabc99dbef705ac83dfa347c5f12b584ceec8b4f2fa7997a3f12722944987e65620d2f8764174e2145e7b3e7cf31372f4a591a38e4fc4496063f03e35b7

  • SSDEEP

    24576:CuQ4MROxnFD3+74S4xrZlI0AilFEvxHiVq7:CuzMiJxrZlI0AilFEvxHi4

  Score

  10^/10

  orcusdiscoveryratspywarestealer

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcus family

    orcus

  • Orcus main payload

  • Orcurs Rat Executable

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  behavioral1behavioral2