General
-
Target
00a7b6cbeb76f66bec8afb8de1fccc230d0dd2a16211fa9ca1d93e7f8cb462d1
-
Size
81KB
-
Sample
221019-gxvytsehc3
-
MD5
67ff9e4ec5b5aae1bdc419007e42b3ad
-
SHA1
6c15cd9e622067b1d83503126194d31584866e37
-
SHA256
00a7b6cbeb76f66bec8afb8de1fccc230d0dd2a16211fa9ca1d93e7f8cb462d1
-
SHA512
49c01d35621b9966a13b7af7fc932efaed728d095304d8ace74f9e86fb2dd694ac618cbdff98ea945e853436640bea28e5ee51fbf9d11633265df11864d5388b
-
SSDEEP
768:z4nOvX4OBv46uqu7eHjHTFoknMVs42/wkIzIT0skBrUBQ8P8TRMk9BQ+5tkiAL5K:6y3hUOFnFLIzGLPsTRzM1FgsC
Static task
static1
Malware Config
Extracted
quasar
1.4.0
SKYNET
173.225.115.99:7702
938cda17-a814-4925-8420-83a35a350164
-
encryption_key
F04A75E6507173FAEEC2BB82C564030A5E8413FF
-
install_name
FileHistory.exe
-
log_directory
Logs
-
reconnect_delay
4000
-
startup_key
FileHistory
-
subdirectory
FileHistory
Extracted
orcus
146.70.143.176:81
712d31c7a3f54904a08d968a15b836e9
-
autostart_method
Registry
-
enable_keylogger
false
-
install_path
%programfiles%\orc\orc.exe
-
reconnect_delay
10000
-
registry_keyname
orc
-
taskscheduler_taskname
orc
-
watchdog_path
AppData\Watchdog.exe
Targets
-
-
Target
00a7b6cbeb76f66bec8afb8de1fccc230d0dd2a16211fa9ca1d93e7f8cb462d1
-
Size
81KB
-
MD5
67ff9e4ec5b5aae1bdc419007e42b3ad
-
SHA1
6c15cd9e622067b1d83503126194d31584866e37
-
SHA256
00a7b6cbeb76f66bec8afb8de1fccc230d0dd2a16211fa9ca1d93e7f8cb462d1
-
SHA512
49c01d35621b9966a13b7af7fc932efaed728d095304d8ace74f9e86fb2dd694ac618cbdff98ea945e853436640bea28e5ee51fbf9d11633265df11864d5388b
-
SSDEEP
768:z4nOvX4OBv46uqu7eHjHTFoknMVs42/wkIzIT0skBrUBQ8P8TRMk9BQ+5tkiAL5K:6y3hUOFnFLIzGLPsTRzM1FgsC
-
Orcus main payload
-
Quasar payload
-
Orcurs Rat Executable
-
PlagueBot Executable
-
Downloads MZ/PE file
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Drops file in System32 directory
-