Extracted

• • Target

    d2777267df8fcd7948a7e5c07bc3ad7dfc3a363d3ac1da4992dd93f9a611df93

  • Size

    2.6MB

  • MD5

    9f72876e7a54fb08f30a45732749952b

  • SHA1

    b2085f2f7b31e101bb140aa564cda1d0caa6f1da

  • SHA256

    d2777267df8fcd7948a7e5c07bc3ad7dfc3a363d3ac1da4992dd93f9a611df93

  • SHA512

    c5d30b01a72b7d156fefc6be9ad5ff6e3c0cfe134bc4d66e41ce28dbf12f07d0c55fdd360949b4aa7549f19ceb00695cd86eaae9394bac5e2efb6c073673d2bb

  • SSDEEP

    24576:QAHnh+eWsN3skA4RV1Hom2KXSmHdqf0K44JzixdvW80EXLq31gEfUvWDyBFZpxxT:Hh+ZkldoPKiYdqd6L

  Score

  10^/10

  orcusligeonratspywarestealer

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcurs Rat Executable

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2