Overview

overview

10

Static

static

10

Orcuido.exe

windows7-x64

10

Orcuido.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Orcuido.exe

  • Size

    3.1MB

  • Sample

    230330-bhsl9sae52

  • MD5

    00535440a40587b5b08ba0b98dfeb4b3

  • SHA1

    7ca280a1dc7102c3f371b748b8e9b6a13cf09b29

  • SHA256

    3641770670faf667b289df978513c46c31b2074cd5504cbd73dccc510e394ace

  • SHA512

    0ba4d4630ffdab08a9a6849b88321a6eba7b4233ff09c2373520ac98632509cbbb9f4939e2bfaa1021b04c2c8a13f172fa6bf4fed2363f195dadf2d4b8175868

  • SSDEEP

    49152:DvCI22SsaNYfdPBldt698dBcjHqxDE/Avk/JxPoGdIfhTHHB72eh2NT:DvP22SsaNYfdPBldt6+dBcjHqxQNi

Score
10/10
quasarorcusspywaretrojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Orcus

C2

Rares14023-51676.portmap.host:51676

Mutex

eabc7ac9-6a8c-4e27-bfcf-1cbc46331ce7

Attributes
  • encryption_key

    1A1B74C3A45D7286503C40C19ECC5088F044534B

  • install_name

    OrcusRat.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Discord

  • subdirectory

    SubDir

Targets

    • Target

      Orcuido.exe

    • Size

      3.1MB

    • MD5

      00535440a40587b5b08ba0b98dfeb4b3

    • SHA1

      7ca280a1dc7102c3f371b748b8e9b6a13cf09b29

    • SHA256

      3641770670faf667b289df978513c46c31b2074cd5504cbd73dccc510e394ace

    • SHA512

      0ba4d4630ffdab08a9a6849b88321a6eba7b4233ff09c2373520ac98632509cbbb9f4939e2bfaa1021b04c2c8a13f172fa6bf4fed2363f195dadf2d4b8175868

    • SSDEEP

      49152:DvCI22SsaNYfdPBldt698dBcjHqxDE/Avk/JxPoGdIfhTHHB72eh2NT:DvP22SsaNYfdPBldt6+dBcjHqxQNi

    Score
    10/10
    quasarorcusspywaretrojan

    • Quasar RAT

      Quasar is an open source Remote Access Tool.

      trojanspywarequasar

    • Quasar payload

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    behavioral1behavioral2

MITRE ATT&CK Enterprise v6

Tasks