orcus

General

Target

d199df5116446417372082be7c4f7c8e.exe
Size

300KB
Sample

221019-g9glzaehd8
MD5

d199df5116446417372082be7c4f7c8e
SHA1

17f277eaf2fb5ed78a1c9228526243c857bc6f94
SHA256

bf45d7d41cf421da9cf70d0616d2e2ed599829a190fbfc6b6fd1170cecc5657a
SHA512

06901506c965fa2006113bbeca6521391f9a088a4d44a2bfa13f3b5b05098a75fc1917e63bf9a87aaea4bbe7d4474c5398dcde4d0c8bff64dfc6eaca19aa42da
SSDEEP

3072:el5BwFKLCSdgCb9HICw6EHIzcfbPrk+sGF9X77LA3Di0S8NIPMH/A31TYpOh9bs:Ezfz+62jjgDyA3cPM43OpEbs

Score

10^/10

Malware Config

Extracted

Family

quasar

Version

1.4.0

Botnet

SKYNET

C2

173.225.115.99:7702

Mutex

938cda17-a814-4925-8420-83a35a350164

Attributes

encryption_key
F04A75E6507173FAEEC2BB82C564030A5E8413FF
install_name
FileHistory.exe
log_directory
Logs
reconnect_delay
4000
startup_key
FileHistory
subdirectory
FileHistory

Extracted

Family

orcus

C2

146.70.143.176:81

Mutex

712d31c7a3f54904a08d968a15b836e9

Attributes

autostart_method
Registry
enable_keylogger
false
install_path
%programfiles%\orc\orc.exe
reconnect_delay
10000
registry_keyname
orc
taskscheduler_taskname
orc
watchdog_path
AppData\Watchdog.exe

Targets

- Target
  
  d199df5116446417372082be7c4f7c8e.exe
- Size
  
  300KB
- MD5
  
  d199df5116446417372082be7c4f7c8e
- SHA1
  
  17f277eaf2fb5ed78a1c9228526243c857bc6f94
- SHA256
  
  bf45d7d41cf421da9cf70d0616d2e2ed599829a190fbfc6b6fd1170cecc5657a
- SHA512
  
  06901506c965fa2006113bbeca6521391f9a088a4d44a2bfa13f3b5b05098a75fc1917e63bf9a87aaea4bbe7d4474c5398dcde4d0c8bff64dfc6eaca19aa42da
- SSDEEP
  
  3072:el5BwFKLCSdgCb9HICw6EHIzcfbPrk+sGF9X77LA3Di0S8NIPMH/A31TYpOh9bs:Ezfz+62jjgDyA3cPM43OpEbs
Score

10^/10

orcus plaguebot quasar skynet botnet evasion persistence rat spyware stealer trojan
- Contains code to disable Windows Defender
  A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- Modifies security service
  evasion
- Orcus
  Orcus is a Remote Access Trojan that is being sold on underground forums.
  rat spyware stealer orcus
- Orcus main payload
- PlagueBot
  PlagueBot is an open source Bot written in Pascal.
  botnet plaguebot
- Quasar RAT
  Quasar is an open source Remote Access Tool.
  trojan spyware quasar
- Quasar payload
- Orcurs Rat Executable
- PlagueBot Executable
- Downloads MZ/PE file
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Drops startup file
- Loads dropped DLL
- Windows security modification
  evasion trojan
- Adds Run key to start application
  persistence
- Drops desktop.ini file(s)
- Drops file in System32 directory
behavioral1 behavioral2