Extracted

• • Target

    01ccc9dd77b0366c90efafb8dc14f1c5b139b54fc5eb8b2409d1b9ab02db3adc

  • Size

    2.6MB

  • MD5

    afe0e2ac8de202b677d3ff9cca2a270c

  • SHA1

    2e0fe6497424dac8b2b07de54348a53ac61a7f1d

  • SHA256

    01ccc9dd77b0366c90efafb8dc14f1c5b139b54fc5eb8b2409d1b9ab02db3adc

  • SHA512

    a12fae2cd828f4ef8d6f12feed7e61bc0389d559aa3f24519d0bd64a2b5928585a52bc84ed047e0ed7507dc4b5d9cce26dc7871dd9f11604485838bc1c9e96f8

  • SSDEEP

    24576:SAHnh+eWsN3skA4RV1Hom2KXSmHdK3VqbE6przwKpwvEuM/SD0wugdDEl6NrL/NV:Vh+ZkldoPKiYdKr9P

  Score

  10^/10

  orcusligeonratspywarestealer

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcurs Rat Executable

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2