Extracted

• • Target

    777bef59b92121d31eb9c67a1ab64ae55cf67f2a7ff4ebf3f485c40dcc87648d

  • Size

    2.6MB

  • MD5

    e345b8d57ec4f2a1b856c40bd7f9b28b

  • SHA1

    397b3387d591c2d0e45024a931b3e420f091f211

  • SHA256

    777bef59b92121d31eb9c67a1ab64ae55cf67f2a7ff4ebf3f485c40dcc87648d

  • SHA512

    94cfa2d9b1542d3440979a3653fab7ec73cdfd706296b4c702d219e58154b89772dfa2289d41d0e18fa4300d7678f63f6b1212a1adb84dd77b905d1a74d85e8f

  • SSDEEP

    24576:SAHnh+eWsN3skA4RV1Hom2KXSmHdK3VqbE6przwKpwvEuM/SD0wugdDEl6NrL/Nh:Vh+ZkldoPKiYdKr97

  Score

  10^/10

  orcusligeonratspywarestealer

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcurs Rat Executable

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Deletes itself

  • Executes dropped EXE

  • AutoIT Executable

    AutoIT scripts compiled to PE executables.

  • Suspicious use of SetThreadContext

  behavioral1behavioral2