Extracted

• • Target

    482ef1db0a970cd2ea34f0f11cce11c65e2174a57e8c782b3897198cbb56248d

  • Size

    2.6MB

  • MD5

    1af82d67488f58d6513bd7cadb9e1c79

  • SHA1

    cb6755de89c312fc6b1cd646ffc3ce571c2bd901

  • SHA256

    482ef1db0a970cd2ea34f0f11cce11c65e2174a57e8c782b3897198cbb56248d

  • SHA512

    e9e4b3ec73ad1bc68342601d31e19553f6cc1124385b6116cd70c9ad4ea76973df4094bf84c0075d474acb2f68893272db262921a20886ca89bdabb3464f72d4

  • SSDEEP

    24576:QAHnh+eWsN3skA4RV1Hom2KXSmHdqf0K44JzixdvW80EXLq31gEfUvWDyBFZpxxS:Hh+ZkldoPKiYdqd6a

  Score

  10^/10

  orcusligeonratspywarestealer

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcurs Rat Executable

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2