orcus

General

Target

tmp
Size

260KB
Sample

221007-fqxy6sbfc9
MD5

2c7eeef34a1b35c0b025c43c7233f453
SHA1

82e361e77aaf426fcc8d18a46391ce2bf064f493
SHA256

cc7dc07df5e85f948998b1d711b7ea362e529799b2f47d35f256ccd901ab3af9
SHA512

50178b34dadedcd370d031b668906ed3016fd79706b87fd665cfdab942a487625d552629d7ec97a300b63b012a412226b0c128a88e96a17f6189896cb2473010
SSDEEP

6144:8ea7tvhFs3Huy3Pu2eAHNabHtqY+dpEnPM43:67FPeOy3Pu8hNdpEk4

Score

10^/10

Malware Config

Extracted

Family

quasar

Version

1.4.0

Botnet

SKYNET

C2

173.225.115.99:7702

Mutex

938cda17-a814-4925-8420-83a35a350164

Attributes

encryption_key
F04A75E6507173FAEEC2BB82C564030A5E8413FF
install_name
FileHistory.exe
log_directory
Logs
reconnect_delay
4000
startup_key
FileHistory
subdirectory
FileHistory

Extracted

Family

orcus

C2

146.70.143.176:81

Mutex

712d31c7a3f54904a08d968a15b836e9

Attributes

autostart_method
Registry
enable_keylogger
false
install_path
%programfiles%\orc\orc.exe
reconnect_delay
10000
registry_keyname
orc
taskscheduler_taskname
orc
watchdog_path
AppData\Watchdog.exe

Targets

- Target
  
  tmp
- Size
  
  260KB
- MD5
  
  2c7eeef34a1b35c0b025c43c7233f453
- SHA1
  
  82e361e77aaf426fcc8d18a46391ce2bf064f493
- SHA256
  
  cc7dc07df5e85f948998b1d711b7ea362e529799b2f47d35f256ccd901ab3af9
- SHA512
  
  50178b34dadedcd370d031b668906ed3016fd79706b87fd665cfdab942a487625d552629d7ec97a300b63b012a412226b0c128a88e96a17f6189896cb2473010
- SSDEEP
  
  6144:8ea7tvhFs3Huy3Pu2eAHNabHtqY+dpEnPM43:67FPeOy3Pu8hNdpEk4
Score

10^/10

orcus plaguebot quasar skynet botnet evasion persistence rat spyware stealer trojan
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Modifies security service
  evasion
- Orcus
  Orcus is a Remote Access Trojan that is being sold on underground forums.
  rat spyware stealer orcus
- Orcus main payload
- PlagueBot
  PlagueBot is an open source Bot written in Pascal.
  botnet plaguebot
- Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar payload
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Orcurs Rat Executable
- PlagueBot Executable
- Downloads MZ/PE file
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2