Extracted

• • Target

    2c11766bf715b2d80a4252a6847425d3d9d04700b7327a3d58de5173f8fec7b5

  • Size

    2.6MB

  • MD5

    8849cedeec4cceb4babb8cf9a8d683b7

  • SHA1

    ca31e74ac27a7473462364d0077c19802e3bf1c0

  • SHA256

    2c11766bf715b2d80a4252a6847425d3d9d04700b7327a3d58de5173f8fec7b5

  • SHA512

    46b738cf4e7aed4cb33e6cd1dae59feac158ff787909822f085677dbef10afd09acfe65895bffab5a96d6ac640524622622ce4f88a17c50664f55bb1b4e89d4e

  • SSDEEP

    24576:SAHnh+eWsN3skA4RV1Hom2KXSmHdK3VqbE6przwKpwvEuM/SD0wugdDEl6NrL/Ng:Vh+ZkldoPKiYdKr9W

  Score

  10^/10

  orcusligeonratspywarestealer

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcurs Rat Executable

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2