Extracted

• • Target

    854ce12f92f067163436be2b5962b907adadd3f594adb84f908bd006ee74ad2a

  • Size

    2.6MB

  • MD5

    a111bfe636f907a2b885419f764c25a7

  • SHA1

    8af06e26550f2a6c884e9fed97f6bdafb0656299

  • SHA256

    854ce12f92f067163436be2b5962b907adadd3f594adb84f908bd006ee74ad2a

  • SHA512

    f9b84c96388547874f4f38c72f17462c2bf84e511fad8d3911c0ccaed4e4b50b998c6a7a35315eede97b24b8ff7ffb334e456e490781c0f6bb9193d84a705401

  • SSDEEP

    24576:QAHnh+eWsN3skA4RV1Hom2KXSmHdqf0K44JzixdvW80EXLq31gEfUvWDyBFZpxxF:Hh+ZkldoPKiYdqd6t

  Score

  10^/10

  orcusligeonratspywarestealer

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcurs Rat Executable

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2