Extracted

• • Target

    716c006e24d4cf6a68e10a4994ba6d25eeb5b08e3b8a3d4b85615918340389c6

  • Size

    2.6MB

  • MD5

    a8114c9fcefe1d63af9efea536891fce

  • SHA1

    141db0e8536a567a392efd6eef6a975f9707be18

  • SHA256

    716c006e24d4cf6a68e10a4994ba6d25eeb5b08e3b8a3d4b85615918340389c6

  • SHA512

    f52af35045ffca0485c7579178f8715fff7631865858e3ce88fad69d75e24274f6d5831712e3fd779647de166651d7219e24f02c1ba3dca751130e9bd12ca98d

  • SSDEEP

    24576:SAHnh+eWsN3skA4RV1Hom2KXSmHdK3VqbE6przwKpwvEuM/SD0wugdDEl6NrL/NY:Vh+ZkldoPKiYdKr9y

  Score

  10^/10

  orcusligeonratspywarestealer

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcurs Rat Executable

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2