Extracted

• • Target

    6f4fe8932a9950e7ef10385b0dc250375d747a0f79c4ff83f7ea247b4154e540

  • Size

    2.6MB

  • MD5

    5f4c17dd08313ff9a678db7e3e5ce11d

  • SHA1

    e9539fff9f44d99bf5a14e32398031a3c416bfc2

  • SHA256

    6f4fe8932a9950e7ef10385b0dc250375d747a0f79c4ff83f7ea247b4154e540

  • SHA512

    488524d07bc7daa4656db295abede19b4f2f18d8bf063ddf98d59ab6f6aabb8f7bbbec0870b05aac8188fe5cc8a01da09c39e94349bea0d2ca78e77b1d3562d8

  • SSDEEP

    24576:SAHnh+eWsN3skA4RV1Hom2KXSmHdK3VqbE6przwKpwvEuM/SD0wugdDEl6NrL/Na:Vh+ZkldoPKiYdKr9k

  Score

  10^/10

  orcusligeonratspywarestealer

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Detects executables containing common artifacts observed in infostealers

  • Detects executables manipulated with Fody

  • Orcurs Rat Executable

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2