Extracted

• • Target

    f4b25b3a4c8e425c0781ffda643dada0767ffb1cfebe48812249e599897c288c

  • Size

    2.6MB

  • MD5

    33886bc9b9642ff5653f31b905647de7

  • SHA1

    1c16e860dd47866f3d6b8cfcaef93cd5703a2049

  • SHA256

    f4b25b3a4c8e425c0781ffda643dada0767ffb1cfebe48812249e599897c288c

  • SHA512

    b0723787bcc44ced604a693dc271e8591164bf497d8b3512fa740e72111c35d6e3d5e8521b54013753cbe5807e48e08b466ba06b4a18cec48d7f2a7134894672

  • SSDEEP

    24576:SAHnh+eWsN3skA4RV1Hom2KXSmHdK3VqbE6przwKpwvEuM/SD0wugdDEl6NrL/N8:Vh+ZkldoPKiYdKr92

  Score

  10^/10

  orcusligeonratspywarestealer

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcurs Rat Executable

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2