Overview

overview

10

Static

static

10

cheker.exe

windows7-x64

10

cheker.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    cheker.exe

  • Size

    921KB

  • MD5

    41394beb6f31b8215c7b9d0b8d412c3e

  • SHA1

    c0436e7d59d3be57a1edc94ce52a5e03312aa368

  • SHA256

    9f2151b2fd626d5139a7a292b4faffdedcc45346953b0ce71fa281615e6f350a

  • SHA512

    dfd7ee246b53878037323ed246cf0aea90d43071a1499512e9db0b1b29376ab4cc09739ea03186839d47b7f2b54aa32c395eac4e67a6d32e7b37a78e4b5d9e1b

  • SSDEEP

    24576:n6A4MROxnF43F9MQrrZlI0AilFEvxHihrTE:n6jMiG4wrZlI0AilFEvxHih

Score
10/10
orcus

Malware Config

Extracted

Family

orcus

C2

147.185.221.229:56094

Mutex

0a90560fd1de4ef0859fc02bececce78

Attributes
  • autostart_method

    Registry

  • enable_keylogger

    true

  • install_path

    %programfiles%\svhost\svhost.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\svhost.exe

Signatures

  • Orcurs Rat Executable 1 IoCs
  • Orcus family
    orcus
  • Orcus main payload 1 IoCs

Files

  • cheker.exe
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections