Extracted

• • Target

    503f849e566b78fedd83c4de58214b6dcdccc1bcd9bb20e2a44adb09cca8a5c1

  • Size

    2.6MB

  • MD5

    23893497c10ea9e321d6bf8308762beb

  • SHA1

    7b9a015f1e48e0298502ef9b8104cf55f5a34c72

  • SHA256

    503f849e566b78fedd83c4de58214b6dcdccc1bcd9bb20e2a44adb09cca8a5c1

  • SHA512

    30db6133d316ce4c43fc7adc698e7fac8f0e18cb283eb78c45ec01c93100c509cab1bcb28332dd5faad39218cd4d405029cba32d4a9475204d46252364eb134b

  • SSDEEP

    24576:SAHnh+eWsN3skA4RV1Hom2KXSmHdK3VqbE6przwKpwvEuM/SD0wugdDEl6NrL/NS:Vh+ZkldoPKiYdKr90

  Score

  10^/10

  orcusligeonratspywarestealer

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcurs Rat Executable

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2