Extracted

• • Target

    cb84c03153bcde957f318598157f0decf4f7f45d8b8101e481fc425840faf451

  • Size

    2.6MB

  • MD5

    6e697b20597171bc19a8e9ec43386b56

  • SHA1

    5dfb03804e19c4a48a1c6e1fc779611f290daed6

  • SHA256

    cb84c03153bcde957f318598157f0decf4f7f45d8b8101e481fc425840faf451

  • SHA512

    ba17062eca2c6cf94287f91429ca72a9f4dd7a9f7dabca487e3f1c68b575f601302ad5754321ee4cf90322cb2ca2b5c342edd9236226a7105194eba6bda68c1f

  • SSDEEP

    24576:SAHnh+eWsN3skA4RV1Hom2KXSmHdK3VqbE6przwKpwvEuM/SD0wugdDEl6NrL/NY:Vh+ZkldoPKiYdKr9y

  Score

  10^/10

  orcusligeonratspywarestealer

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcurs Rat Executable

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2