Extracted

• • Target

    5ac99b04c2f7c90d27b7c9d6da967a9799be04d379774430424d556fa81c88b6

  • Size

    2.6MB

  • MD5

    31d3006d21f2489716daf54b8a411eb2

  • SHA1

    7322b761b0b6053a2afe9f3f4730156986834d7f

  • SHA256

    5ac99b04c2f7c90d27b7c9d6da967a9799be04d379774430424d556fa81c88b6

  • SHA512

    0a1699ea09be64efc3fb64c877c23ae2b31fe45b89db91a406b133b146d52ce60c931ffca6d3bc8a9f06997c99fb94a9e7dda58c7f4d58402ab01fd5796fe820

  • SSDEEP

    24576:SAHnh+eWsN3skA4RV1Hom2KXSmHdK3VqbE6przwKpwvEuM/SD0wugdDEl6NrL/ND:Vh+ZkldoPKiYdKr9t

  Score

  10^/10

  orcusligeonratspywarestealer

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcurs Rat Executable

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2