Extracted

• • Target

    4425d4a2c6f7c002dde0e2874f904d7f1a6bf79c2d84a662d89dc37c3dd5e595

  • Size

    2.6MB

  • MD5

    39591f56f244d021cf877648bfe5a349

  • SHA1

    3240848df89d213471bebee6cabe6578ff8a7d68

  • SHA256

    4425d4a2c6f7c002dde0e2874f904d7f1a6bf79c2d84a662d89dc37c3dd5e595

  • SHA512

    d8ec542cb307da23af7bf0b345fec15a965dcc20b09c4f5c3de114411c661027e2a1a143725e955ecd294f2d6a73055e4c1064cf05f3a19799be1c5ae4d13dee

  • SSDEEP

    24576:SAHnh+eWsN3skA4RV1Hom2KXSmHdK3VqbE6przwKpwvEuM/SD0wugdDEl6NrL/NJ:Vh+ZkldoPKiYdKr9L

  Score

  10^/10

  orcusligeonratspywarestealer

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcurs Rat Executable

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2