Extracted

• • Target

    086319facaee00df329432b8ccd999fe0ba8a079c64e107deb7e23395e52bf4d

  • Size

    2.6MB

  • MD5

    479f7e3e973f2776141c58f7e4ed4858

  • SHA1

    5f34a9935ca417ed555a920d6f0cec6c0c00b8a7

  • SHA256

    086319facaee00df329432b8ccd999fe0ba8a079c64e107deb7e23395e52bf4d

  • SHA512

    557cf98d7b1794dd06671c89585e23e5758a03bce7ad1370bd1092750b85fda2845e100875424cf5c7eaf4811b3b38636f8263cc0e7fcf5fbcd935c8c6a5f863

  • SSDEEP

    24576:QAHnh+eWsN3skA4RV1Hom2KXSmHdqf0K44JzixdvW80EXLq31gEfUvWDyBFZpxx9:Hh+ZkldoPKiYdqd61

  Score

  10^/10

  orcusligeonratspywarestealer

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcurs Rat Executable

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2