Extracted

• • Target

    e9f459ddaf4961c54b95ebe376e811b80023517ce4cc0ad7c4d9371c273709b1

  • Size

    2.6MB

  • MD5

    40926040980e5d4c8269d06c26d8982f

  • SHA1

    034db414994319cc08ca6a29eea8227537ec4ee5

  • SHA256

    e9f459ddaf4961c54b95ebe376e811b80023517ce4cc0ad7c4d9371c273709b1

  • SHA512

    cf0209da22303a91e8bf487640f9dd38820017fb7a93dcc5dca809fc6290e0070ca10e801c7d0be49efcca5bf1eddf21708f8437516fb78648d5a67970cd4944

  • SSDEEP

    24576:QAHnh+eWsN3skA4RV1Hom2KXSmHdqf0K44JzixdvW80EXLq31gEfUvWDyBFZpxxr:Hh+ZkldoPKiYdqd6z

  Score

  10^/10

  orcusligeonratspywarestealer

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcurs Rat Executable

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2