Overview

overview

10

Static

static

10

Quent.exe

windows10-2004-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target

    Quent.exe

  • Size

    920KB

  • MD5

    d61f3c97465ffe9ce3813767b96b11d3

  • SHA1

    ab3af469abee624f541ab686f6a58eedb6ca9070

  • SHA256

    f50f764cdfbe4e8097871aaee2a7eaf37bd164b456dd272a11a672cc54c2a8a6

  • SHA512

    3e95aa9b17f251de1eabbd0639a3298fae258ae138d447415261e8543c2a75cc358ca9dc5d3cae33ea1dbda71eb71acfb881604bb1929b40402d59690963a6bf

  • SSDEEP

    24576:eD54MROxnFt34cdrrcI0AilFEvxHPDoom:eSMijfrrcI0AilFEvxHP

Score
10/10
orcus

Malware Config

Extracted

Family

orcus

C2

animals-sewing.at.ply.gg:41503

Mutex

1d6a75b7940d40cb9030c731d6bec093

Attributes
  • autostart_method

    Registry

  • enable_keylogger

    true

  • install_path

    %programfiles%/Runtime/RuntimeBroker.exe

  • reconnect_delay

    10000

  • registry_keyname

    WindowsUpdat

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\Runtume Broker.exe

Signatures

  • Orcurs Rat Executable 1 IoCs
  • Orcus family
    orcus
  • Orcus main payload 1 IoCs

Files

  • Quent.exe
    .exe windows x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections