Extracted

• • Target

    971268671d809576aae9dea9f7ece7e7e1b74bb8182b6d193fdbbf74457db4fc

  • Size

    2.6MB

  • MD5

    4e11a9dbc207cc7277531dcf1e383582

  • SHA1

    ccb89e61b97077a291c17dc9e2adf4825ac06c24

  • SHA256

    971268671d809576aae9dea9f7ece7e7e1b74bb8182b6d193fdbbf74457db4fc

  • SHA512

    170a46f5946425fcb33581834b6faba1b2c520e41cfdc5f3dcdae3f346996b24d055913988c76547b71a166412e8cc69c6de7d27ec6cf138472b493d3267ad0f

  • SSDEEP

    24576:QAHnh+eWsN3skA4RV1Hom2KXSmHdqf0K44JzixdvW80EXLq31gEfUvWDyBFZpxx7:Hh+ZkldoPKiYdqd6z

  Score

  10^/10

  orcusligeonratspywarestealer

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcurs Rat Executable

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2