Extracted

• • Target

    5910aa00e8a3ffa7f8abb45d6e8f23307b1f152d6f6a2bbfb9be8215b0b2d26a

  • Size

    2.6MB

  • MD5

    b885348763d4c179cf29b9768cc76acf

  • SHA1

    16ce094f522f0726f8fb35d0043ab9e424140890

  • SHA256

    5910aa00e8a3ffa7f8abb45d6e8f23307b1f152d6f6a2bbfb9be8215b0b2d26a

  • SHA512

    f78ea20abc1481a000e8f3660383fc71bb266035b2fd549e0d78b048e8d8c1a94f1307d49b414179efad59e0624423d6d1a22eb2a3736e4c5eeee148c0e0b4e7

  • SSDEEP

    24576:SAHnh+eWsN3skA4RV1Hom2KXSmHdK3VqbE6przwKpwvEuM/SD0wugdDEl6NrL/Ns:Vh+ZkldoPKiYdKr9e

  Score

  10^/10

  orcusligeonratspywarestealer

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcurs Rat Executable

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2