Extracted

• • Target

    10fff4171c78717bc1043fcf579e2bdfe2ba391da03a3074a180d87021924ebf

  • Size

    2.6MB

  • MD5

    6103fc199a912143d92708e60fbd1ed0

  • SHA1

    23dd0f10ae76d56780c24d50e4010a6dfeb43f63

  • SHA256

    10fff4171c78717bc1043fcf579e2bdfe2ba391da03a3074a180d87021924ebf

  • SHA512

    9a8cc48ee43564523b038b11de8be41b7c19dbbf5fcd407c424c8486483981678a2ad4e3eaa3c5a96c7e6a002c5178d95eef25b0f328bba7586d463f1c91d4ac

  • SSDEEP

    24576:SAHnh+eWsN3skA4RV1Hom2KXSmHdK3VqbE6przwKpwvEuM/SD0wugdDEl6NrL/Nc:Vh+ZkldoPKiYdKr9+

  Score

  10^/10

  orcusligeonratspywarestealer

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcurs Rat Executable

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2