Extracted

• • Target

    7d3ff41aa5d49850c1cf03efca3fada83685051c892a45179c87cbeddc1d40bb

  • Size

    2.6MB

  • MD5

    127c640df3b7f0606446b2a1b40b0ea6

  • SHA1

    11b5e48b1954b22a8bf69d930d48aaf6fcab346e

  • SHA256

    7d3ff41aa5d49850c1cf03efca3fada83685051c892a45179c87cbeddc1d40bb

  • SHA512

    6f5598afac92c797a80d3f6da6421665d0a7b791f3b3d220228aa2f526e270c2e6d7f324934690b7445fc59a1b1c70ae88f89bfad99201efd9227e38a7ac7395

  • SSDEEP

    24576:SAHnh+eWsN3skA4RV1Hom2KXSmHdK3VqbE6przwKpwvEuM/SD0wugdDEl6NrL/N3:Vh+ZkldoPKiYdKr95

  Score

  10^/10

  orcusligeonratspywarestealer

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcurs Rat Executable

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2