General
-
Target
Orcuido.exe
-
Size
3.1MB
-
Sample
230330-bhsl9sae52
-
MD5
00535440a40587b5b08ba0b98dfeb4b3
-
SHA1
7ca280a1dc7102c3f371b748b8e9b6a13cf09b29
-
SHA256
3641770670faf667b289df978513c46c31b2074cd5504cbd73dccc510e394ace
-
SHA512
0ba4d4630ffdab08a9a6849b88321a6eba7b4233ff09c2373520ac98632509cbbb9f4939e2bfaa1021b04c2c8a13f172fa6bf4fed2363f195dadf2d4b8175868
-
SSDEEP
49152:DvCI22SsaNYfdPBldt698dBcjHqxDE/Avk/JxPoGdIfhTHHB72eh2NT:DvP22SsaNYfdPBldt6+dBcjHqxQNi
Behavioral task
behavioral1
Sample
Orcuido.exe
Resource
win7-20230220-en
Malware Config
Extracted
quasar
1.4.1
Orcus
Rares14023-51676.portmap.host:51676
eabc7ac9-6a8c-4e27-bfcf-1cbc46331ce7
-
encryption_key
1A1B74C3A45D7286503C40C19ECC5088F044534B
-
install_name
OrcusRat.exe
-
log_directory
Logs
-
reconnect_delay
3000
-
startup_key
Discord
-
subdirectory
SubDir
Targets
-
-
Target
Orcuido.exe
-
Size
3.1MB
-
MD5
00535440a40587b5b08ba0b98dfeb4b3
-
SHA1
7ca280a1dc7102c3f371b748b8e9b6a13cf09b29
-
SHA256
3641770670faf667b289df978513c46c31b2074cd5504cbd73dccc510e394ace
-
SHA512
0ba4d4630ffdab08a9a6849b88321a6eba7b4233ff09c2373520ac98632509cbbb9f4939e2bfaa1021b04c2c8a13f172fa6bf4fed2363f195dadf2d4b8175868
-
SSDEEP
49152:DvCI22SsaNYfdPBldt698dBcjHqxDE/Avk/JxPoGdIfhTHHB72eh2NT:DvP22SsaNYfdPBldt6+dBcjHqxQNi
-
Quasar payload
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-