Extracted

• • Target

    bb34623ab8f06b965fc6af6f6d9ee512f5c243060f3c4174fc5190a3117e5fb3

  • Size

    2.6MB

  • MD5

    1c594a9437c6b52efd3a0e27d658bbd2

  • SHA1

    63937ce05b1b9954ba25e217c098483eabd32438

  • SHA256

    bb34623ab8f06b965fc6af6f6d9ee512f5c243060f3c4174fc5190a3117e5fb3

  • SHA512

    f6838f4656572b385dc127565d3222d6a2b3d7e43b0dfca033f898d504dd59121d587462c125f5a95502478af206303a5ebc07221034a3ad49e7864483d6a6c3

  • SSDEEP

    24576:QAHnh+eWsN3skA4RV1Hom2KXSmHdqf0K44JzixdvW80EXLq31gEfUvWDyBFZpxxX:Hh+ZkldoPKiYdqd6P

  Score

  10^/10

  orcusligeonratspywarestealer

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcurs Rat Executable

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2