Extracted

• • Target

    c167cebeecd86a37aacbfcdd9594cb671614418417bbdd5c515d3ee1b8bb0bb5

  • Size

    2.6MB

  • MD5

    4a8f5f35297bc0651325ea1e941675d5

  • SHA1

    6e27638532c02f34f9dc695c5355bcaad70b51c7

  • SHA256

    c167cebeecd86a37aacbfcdd9594cb671614418417bbdd5c515d3ee1b8bb0bb5

  • SHA512

    f63de42c15f4547a651da26ef245a147b678e8aed4a3875d1d862008961fdf3833363963c59da8a49ed8342877967e805007b747dc844347fc40044f6c028a04

  • SSDEEP

    24576:SAHnh+eWsN3skA4RV1Hom2KXSmHdK3VqbE6przwKpwvEuM/SD0wugdDEl6NrL/Nu:Vh+ZkldoPKiYdKr9U

  Score

  10^/10

  orcusligeonratspywarestealer

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcurs Rat Executable

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2