Extracted

• • Target

    8a3bfcb07b39f30c15062191252d2d509cd72693fd1ea812952510ecd9c4beaa

  • Size

    2.6MB

  • MD5

    2c594813a0c5b2acc5f13aa324c3df38

  • SHA1

    fd1ce85c2cf71d8e46df64af0a5ae86bcff458cd

  • SHA256

    8a3bfcb07b39f30c15062191252d2d509cd72693fd1ea812952510ecd9c4beaa

  • SHA512

    65af6798d1cd497473f6eb7319e2445cd80c674df19d29e09bae1a40dad2d68e162c1ef01a7f4369423a511aff734e4e32183f70a204f943512fba7f89bf32fe

  • SSDEEP

    24576:QAHnh+eWsN3skA4RV1Hom2KXSmHdqf0K44JzixdvW80EXLq31gEfUvWDyBFZpxxN:Hh+ZkldoPKiYdqd6l

  Score

  10^/10

  orcusligeonratspywarestealer

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcurs Rat Executable

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2