Extracted

• • Target

    d4205c32a32976e3ff2cf981e2959ed4a8df9689a4c17bfc5b6d860666912417

  • Size

    2.6MB

  • MD5

    a1de47f3e2c2d8384e730f62414b45e9

  • SHA1

    5f886112de96a5d414c34a9b48ddbdb8dba9a419

  • SHA256

    d4205c32a32976e3ff2cf981e2959ed4a8df9689a4c17bfc5b6d860666912417

  • SHA512

    10abb7c01414f773b61ec2abd23eb36f04d9b5e6c8cefe8ab7806df9721787531535c6b2064bb4c4a18c867a5c92a8886a2c1728dbdf099968bee07e6c124996

  • SSDEEP

    24576:QAHnh+eWsN3skA4RV1Hom2KXSmHdqf0K44JzixdvW80EXLq31gEfUvWDyBFZpxx3:Hh+ZkldoPKiYdqd6P

  Score

  10^/10

  orcusligeonratspywarestealer

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcurs Rat Executable

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2