Extracted

• • Target

    f37efd5834c04b7f90ee50188474ebc8a917f83a48edd87e7a0556415f0b3621

  • Size

    2.6MB

  • MD5

    942e6d4d79fafc99f4339e0cd957675d

  • SHA1

    03f5cadf461749cd06cd4defd93e31e3ce9e716f

  • SHA256

    f37efd5834c04b7f90ee50188474ebc8a917f83a48edd87e7a0556415f0b3621

  • SHA512

    1192451b24280780b65881c4a27b09cbe98fccc836819832554796d0dd966ab29dfe27afd0476efb2f73689b992813a8e63f1525c49395a5d41e3a90493a3130

  • SSDEEP

    24576:QAHnh+eWsN3skA4RV1Hom2KXSmHdqf0K44JzixdvW80EXLq31gEfUvWDyBFZpxx9:Hh+ZkldoPKiYdqd6l

  Score

  10^/10

  orcusligeonratspywarestealer

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcurs Rat Executable

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2