Extracted

• • Target

    b97d9b589c2931147eab41d5ee99b319abe99ab395eed4f98b38317ba4bdc0e3

  • Size

    2.6MB

  • MD5

    c823da71212745fc28bc1db3a945195a

  • SHA1

    0babf35f07567cff0b9fc9a2d66dcb21d45a24ae

  • SHA256

    b97d9b589c2931147eab41d5ee99b319abe99ab395eed4f98b38317ba4bdc0e3

  • SHA512

    09524ed1afe09b289fbbe1629e9d266ca99ab7668d86851fb78bdfb5471ed2266bc2dab6d556c77b00601dce451fef6642c07da5519e3cd7e768663a1120b938

  • SSDEEP

    24576:QAHnh+eWsN3skA4RV1Hom2KXSmHdqf0K44JzixdvW80EXLq31gEfUvWDyBFZpxxy:Hh+ZkldoPKiYdqd6K

  Score

  10^/10

  orcusligeonratspywarestealer

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcurs Rat Executable

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2