Extracted

Extracted

• • Target

    3d8c4196a887f0056103f09ca6717826.exe

  • Size

    20KB

  • MD5

    3d8c4196a887f0056103f09ca6717826

  • SHA1

    b8993d7cdeab70f1775f486837ae671ed3cce456

  • SHA256

    aa9deb2a1d67a4e73e7419b86535f1197dc8b7ffebdd392fb35f7c10d92b9dc1

  • SHA512

    88c8ccad020ea479b7eba1dd4b4b8e86ac13485c79f41ef39f552b58819fb70d6a75e339ebf9cea8a06d7e5ab4dd775081da91ce46a5f952453ce4471b6a2d22

  • SSDEEP

    384:MntlikEpJ6xs9oNUhW2Ob0JaMRPJFInKZBsgbN1aO9sdBnfk7:MntZ0fyb0JpEalpv6nfk

  Score

  10^/10

  orcusplaguebotquasarskynetbotnetpersistenceratspywarestealertrojan

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcus main payload

  • PlagueBot

    PlagueBot is an open source Bot written in Pascal.

    botnetplaguebot

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar payload

  • Orcurs Rat Executable

  • PlagueBot Executable

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Loads dropped DLL

  • Adds Run key to start application

    persistence

  • Drops desktop.ini file(s)

  • Drops file in System32 directory

  behavioral1behavioral2