Extracted

• • Target

    2c542179b4fa4684c454c5df61d302562b8aaf156040061cc09025b051cf5786

  • Size

    2.6MB

  • MD5

    bc0eb9a9ef73434b4d574f5360118564

  • SHA1

    2e7efe15fc110eaad80b3901ae5580814ce4c267

  • SHA256

    2c542179b4fa4684c454c5df61d302562b8aaf156040061cc09025b051cf5786

  • SHA512

    a4769799e6f783686bc522000c6eda7f3b524054452afb484f601cab7abc66675f1592e47c4195e72c882e00c87785db7e36327aa77eba45ef511d7b2b97841e

  • SSDEEP

    24576:QAHnh+eWsN3skA4RV1Hom2KXSmHdqf0K44JzixdvW80EXLq31gEfUvWDyBFZpxxa:Hh+ZkldoPKiYdqd6C

  Score

  10^/10

  orcusligeonratspywarestealer

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcurs Rat Executable

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2