Extracted

Extracted

• • Target

    rvpn-free.exed

  • Size

    17.9MB

  • MD5

    86d4c18ac23bbf695eacd55514623aeb

  • SHA1

    e3f3212c120cbc7a3561f216eefe0c23c2da457a

  • SHA256

    db82126a67671be3db67ae3b2f871768913d08cb7550f914800dc81e3c4eb992

  • SHA512

    e2e824d97065a467bf5415f57b8bbcb9995a63bed275cc7c07f00d541dbf84fed8320845d0f40d6d1e0ba2ebab38fa327eab5856ecd54f033374eb71f2152be8

  • SSDEEP

    393216:0cwZqjab4a0ZBo7dgAxMfcw7W0DikbXZf83JAJ+rEQZPMRO:01Zq5nadgAefcB0eqJ85iI/ZPM

  Score

  10^/10

  orcusxwormclientsdefense_evasiondiscoveryexecutionpersistencepyinstallerratspywarestealertrojanupx

  • Deletes Windows Defender Definitions

    Uses mpcmdrun utility to delete all AV definitions.

    defense_evasion

  • Detect Xworm Payload

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcus family

    orcus

  • Xworm

    Xworm is a remote access trojan written in C#.

    trojanratxworm

  • Xworm family

    xworm

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory

  • Enumerates processes with tasklist

    discovery

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1