Extracted

• • Target

    2025-04-03_13cf7ea029c663fb9d23c42de350319c_black-basta_cobalt-strike_satacom

  • Size

    22.3MB

  • MD5

    13cf7ea029c663fb9d23c42de350319c

  • SHA1

    d0271394cf525965983616d00e7436104a592402

  • SHA256

    16ea7cd8e6e4a5fab30ed82403bb43669d766c90877d50af8087fea4d97e8701

  • SHA512

    9fe36bf5485fee478f357a4e6d6a9792bb1cd91916c019342b2eb096543c2c21e003d8c05751ac867b74a91cc1d62b37e73b707380e84eb40b8358165e6a91ed

  • SSDEEP

    393216:9qzeQ/Nakg+rhoqQoAOCMVEyXMCHWUj6jx5WsqWxTQ8bNobLq8/II30frDIlJWiP:tQlhp1HHCiEyXMb8psqAhWbLqsI9m8iP

  Score

  10^/10

  orcusdiscoverypyinstallerratspywarestealer

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcus family

    orcus

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Orcurs Rat Executable

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Loads dropped DLL

  • Enumerates processes with tasklist

    discovery
  behavioral1