orcus | Quik[.]exe

General

Target
Quik.exe
Size 920KB
Sample230413-tbarzscd96
SHA256 fb2f72b322e1d62aae04cf8aa456862694846db547b92cfdb62a12e9771c3ba9
MD5 54b6d3e284bae286a54c07f5344b4d20
SHA1 572dcd2531fb963a26cc3d15b3aeb00b963e61c9
SHA512 fa81b518d93868409908c9e6adba78e9124a3e128519629f5ae230281c58fab248000b44966736fe3bd526b204edeedeba66bd331958c92b2123d20c05d2f365
SSDEEP 24576:bkL94MROxnFt3QcarrcI0AilFEvxHPBYoou:wWMijArrcI0AilFEvxHP
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

orcus

Malware Config

Extracted

Family

orcus

C2

animals-sewing.at.ply.gg:41503

Mutex

e36633084e0f4cfa9a48a5ea5d80e748

Attributes

autostart_method
Registry
enable_keylogger
true
install_path
C:\Windows\System32/JavaUpdate/JavaUpd.exe
reconnect_delay
10000
registry_keyname
Orcus
taskscheduler_taskname
Orcus
watchdog_path
AppData\JavaUpd.exe

Signatures

Orcurs Rat Executable 1 IoCs

resource	yara_rule
sample	orcus

Orcus family
orcus

Orcus main payload 1 IoCs

resource	yara_rule
sample	family_orcus

File Explorer

Quik.exe

.exe 920KB

Quik.exe

IMPHASH f34d5f2d4577ed6d9ceec516c1f5a744
SHA256 fb2f72b322e1d62aae04cf8aa456862694846db547b92cfdb62a12e9771c3ba9
MD5 54b6d3e284bae286a54c07f5344b4d20
SHA1 572dcd2531fb963a26cc3d15b3aeb00b963e61c9
SHA512 fa81b518d93868409908c9e6adba78e9124a3e128519629f5ae230281c58fab248000b44966736fe3bd526b204edeedeba66bd331958c92b2123d20c05d2f365
SSDEEP 24576:bkL94MROxnFt3QcarrcI0AilFEvxHPBYoou:wWMijArrcI0AilFEvxHP
MD5 SHA1 SHA512 SSDEEP

windows x86

Orcurs Rat Executable
Orcus main payload

Minor OS version

Major OS version

Entry point

947534

Magic Number

267

Subsystem

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_NO_SEH IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Sharing