Extracted

• • Target

    368270f55118e792a84c77cb2cbbf20c64a1cad367bf24a69dc7c8438472756a

  • Size

    2.6MB

  • MD5

    9fa6c75f691ff913ef2f95b906016a48

  • SHA1

    ac863bdf74e86d7efea88af16011c63aa19e0ead

  • SHA256

    368270f55118e792a84c77cb2cbbf20c64a1cad367bf24a69dc7c8438472756a

  • SHA512

    8d4eb29dc5c298fbf1960e3c4d651dd1f090cdf35470fc384a4c111c79b81012bd44cbc2c9b9a987a2b93779b3afe4f06f3d91d98c93a30409307fc1cddcf09d

  • SSDEEP

    24576:QAHnh+eWsN3skA4RV1Hom2KXSmHdqf0K44JzixdvW80EXLq31gEfUvWDyBFZpxx6:Hh+ZkldoPKiYdqd6S

  Score

  10^/10

  orcusligeonratspywarestealer

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcurs Rat Executable

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2