Extracted

Extracted

• • Target
    2026-10-11_e0ef66a013e6fea26ba01c3a2509db57_agent-tesla_elex_glassworm_orcus-rat_quasar-rat_rhadamanthys_smoke-loader_stealc_stop
  • Size 1.8MB
  • SHA256 4d16ea2627fd545be1118d4b2b834f17915324d20e356fb2f311f729f7961b76
  • MD5 e0ef66a013e6fea26ba01c3a2509db57
  • SHA1 50b574b62eb6dd0ab494c5a1623cf2339e44c235
  • SHA512 24b2faa7b8c997f5303828033cba5182228398c146d62304c23f7a55d1839b21f6d55d9877124ccfa7d192700399eaa71df5e31095e79b1dba311f8730505ba1
  • SSDEEP 49152:7LeVE/BpTeYCpjYySMiQ/rrcI0AilFEvxHPcN6Sl9Te:7CK71CNLSBn
  • TLSH
    T17C95D0013BF96932C1BF7275A77719892378E4172202EA4A395C025C1FDB714AE7A3DB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  xivdefense_evasiondiscoveryorcuspersistenceratspywarestealer

  • Family: Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcus main payload

  • Custom signature

    Detects executables containing common artifacts observed in infostealers

  • Custom signature

    Detects executables manipulated with Fody

  • Orcurs Rat Executable

  • Custom signature

    detects Windows exceutables potentially bypassing UAC using eventvwr.exe

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes a file named after a Windows system binary

    The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

    defense_evasion

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads ssh keys stored on the system

    Tries to access SSH used by SSH programs.

    spywarestealer

  • Adds Run key to start application

    persistence

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Network Service Discovery

    Attempt to gather information on host's network.

    discovery

  • Drops file in System32 directory

  behavioral1behavioral2