Extracted

• • Target

    00d87c913a6a4a3ded61763ed63c196f4f3d79e7aac5b6ebc49b0341ec5bf0f5

  • Size

    2.6MB

  • MD5

    fddf433f759f354b7fcffbbb11196661

  • SHA1

    41ec7591ef29b5d855fa85adfecd6eea1bcf259a

  • SHA256

    00d87c913a6a4a3ded61763ed63c196f4f3d79e7aac5b6ebc49b0341ec5bf0f5

  • SHA512

    cb6a969f87c67b4f03b50af305a734add9b4c41048f5b6b4e8988287ac43eecb1821d345d44bd5fc9116cc5b6de0a03d7ad48ef27047435899b5a69d47ecd2b9

  • SSDEEP

    24576:QAHnh+eWsN3skA4RV1Hom2KXSmHdqf0K44JzixdvW80EXLq31gEfUvWDyBFZpxxU:Hh+ZkldoPKiYdqd68

  Score

  10^/10

  orcusligeonratspywarestealer

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcurs Rat Executable

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2