Extracted

• • Target

    6087c0a7bc24dc6213a73be560a0166465549680c66f956e2fd773af9a5b21c5

  • Size

    2.6MB

  • MD5

    41421ffc8d935a21941da469f67742ff

  • SHA1

    976aab8da7fb2af8b494db447f96156e200bef88

  • SHA256

    6087c0a7bc24dc6213a73be560a0166465549680c66f956e2fd773af9a5b21c5

  • SHA512

    9214ec0e08184b3c973789a178c2df788fd377e2d1756662adc11725d62f5771b9a061821e56b3e6db36163f16fb66985ddecaa863db09a1ecc586e0c6752e08

  • SSDEEP

    24576:SAHnh+eWsN3skA4RV1Hom2KXSmHdK3VqbE6przwKpwvEuM/SD0wugdDEl6NrL/Nn:Vh+ZkldoPKiYdKr9V

  Score

  10^/10

  orcusligeonratspywarestealer

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcurs Rat Executable

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2