Extracted

• • Target

    cheker.exe

  • Size

    921KB

  • MD5

    41394beb6f31b8215c7b9d0b8d412c3e

  • SHA1

    c0436e7d59d3be57a1edc94ce52a5e03312aa368

  • SHA256

    9f2151b2fd626d5139a7a292b4faffdedcc45346953b0ce71fa281615e6f350a

  • SHA512

    dfd7ee246b53878037323ed246cf0aea90d43071a1499512e9db0b1b29376ab4cc09739ea03186839d47b7f2b54aa32c395eac4e67a6d32e7b37a78e4b5d9e1b

  • SSDEEP

    24576:n6A4MROxnF43F9MQrrZlI0AilFEvxHihrTE:n6jMiG4wrZlI0AilFEvxHih

  Score

  10^/10

  orcuspersistenceratspywarestealer

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcus main payload

  • Orcurs Rat Executable

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  behavioral1behavioral2