Extracted

• • Target

    6ee818fc13b3fdcf50768d95acc1cc73d1390e37ab0ff81499c8ca0c58ac96d5

  • Size

    2.6MB

  • MD5

    675e207ba196ede045ff2d8e6e6bec61

  • SHA1

    edb556bb68d5033e8e154a270bacce4d4d7984bb

  • SHA256

    6ee818fc13b3fdcf50768d95acc1cc73d1390e37ab0ff81499c8ca0c58ac96d5

  • SHA512

    91e78a8739952d12e03ced5542a8b0c1912dbd0317b879c27fdbf38f27cbe7b3385678ffe779f4ac8185a33a631ae1e887557573ad8ea48f4d56f22ba69b4cf5

  • SSDEEP

    24576:QAHnh+eWsN3skA4RV1Hom2KXSmHdqf0K44JzixdvW80EXLq31gEfUvWDyBFZpxxI:Hh+ZkldoPKiYdqd6Q

  Score

  10^/10

  orcusligeonratspywarestealer

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcurs Rat Executable

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2