Extracted

• • Target

    2ba7fcf7f06472ae111f33f4667b928fd1ed4d99f094256e46abe0d6b020e757

  • Size

    2.6MB

  • MD5

    3e2ad8d0c4fd454427d92c3bb36be39a

  • SHA1

    92f7d5f9c642c497ef94ffc3152ca60da1a4b394

  • SHA256

    2ba7fcf7f06472ae111f33f4667b928fd1ed4d99f094256e46abe0d6b020e757

  • SHA512

    dd28e91dfcebea1f3426dee4ef3d9264bca3bf45725567abf144a97bfbe4b22fa46b27a8274d4ec4d23c8c48952c260ab2cd23892e0dd08b6bc62de31007a1bb

  • SSDEEP

    24576:SAHnh+eWsN3skA4RV1Hom2KXSmHdK3VqbE6przwKpwvEuM/SD0wugdDEl6NrL/Nv:Vh+ZkldoPKiYdKr9Z

  Score

  10^/10

  orcusligeonratspywarestealer

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcurs Rat Executable

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2