Overview

overview

10

Static

static

10

Orcuido.exe

windows7-x64

10

Orcuido.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Orcuido.exe

  • Size

    3.1MB

  • MD5

    00535440a40587b5b08ba0b98dfeb4b3

  • SHA1

    7ca280a1dc7102c3f371b748b8e9b6a13cf09b29

  • SHA256

    3641770670faf667b289df978513c46c31b2074cd5504cbd73dccc510e394ace

  • SHA512

    0ba4d4630ffdab08a9a6849b88321a6eba7b4233ff09c2373520ac98632509cbbb9f4939e2bfaa1021b04c2c8a13f172fa6bf4fed2363f195dadf2d4b8175868

  • SSDEEP

    49152:DvCI22SsaNYfdPBldt698dBcjHqxDE/Avk/JxPoGdIfhTHHB72eh2NT:DvP22SsaNYfdPBldt6+dBcjHqxQNi

Score
10/10
orcusquasar

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

Orcus

C2

Rares14023-51676.portmap.host:51676

Mutex

eabc7ac9-6a8c-4e27-bfcf-1cbc46331ce7

Attributes
  • encryption_key

    1A1B74C3A45D7286503C40C19ECC5088F044534B

  • install_name

    OrcusRat.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Discord

  • subdirectory

    SubDir

Signatures

  • Quasar family
    quasar
  • Quasar payload 1 IoCs

Files

  • Orcuido.exe
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections