Extracted

• • Target

    33eee25393b21367164bcd9539ff49f9ebadf4a95c565cb94ee64794b360cd06

  • Size

    2.6MB

  • MD5

    b3fad4428db67f9c462d5ee229fc6e2e

  • SHA1

    caa39b12f5aaae4896a909c830d2745978c3ce1c

  • SHA256

    33eee25393b21367164bcd9539ff49f9ebadf4a95c565cb94ee64794b360cd06

  • SHA512

    4010300b55d20b1d8172b5d448351fb64e1d7b86a3c3796c43dcc43396741669ad1c3bb6efc4fbaa76209a4ae8e88ca69fc3a7173700a5aef926ad77d7d34750

  • SSDEEP

    24576:SAHnh+eWsN3skA4RV1Hom2KXSmHdK3VqbE6przwKpwvEuM/SD0wugdDEl6NrL/Nx:Vh+ZkldoPKiYdKr93

  Score

  10^/10

  orcusligeonratspywarestealer

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcurs Rat Executable

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2