Extracted

Extracted

• • Target

    b2b799de79ae7073d1f92584000e7de9ac6ce223e1e1123b6960297df857dc17

  • Size

    2.3MB

  • MD5

    640810384369b5434037b059e178d2cb

  • SHA1

    67f0e5c4df09a2f6fe86574f681569e3d2bd8879

  • SHA256

    b2b799de79ae7073d1f92584000e7de9ac6ce223e1e1123b6960297df857dc17

  • SHA512

    b504a544392c24adb40fa75756470e47cf03b921f2c0bff7f24e3af3a58a6ef2d754a6149fbaba643b1c78d05c31896172863dcd2f4d33d0bf49c46240c81958

  • SSDEEP

    49152:y4AMirXrrcI0AilFEvxHPLPUwXNYSLNTdqjy6:y4AtUwc

  Score

  10^/10

  orcusquasarcom surrogatesystemdiscoveryevasionexecutionpersistenceratspywarestealertrojan

  • Contains code to disable Windows Defender

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Modifies Windows Defender Real-time Protection settings

    evasiontrojan

  • Orcus

    Orcus is a Remote Access Trojan that is being sold on underground forums.

    ratspywarestealerorcus

  • Orcus family

    orcus

  • Orcus main payload

  • Quasar RAT

    Quasar is an open source Remote Access Tool.

    trojanspywarequasar

  • Quasar family

    quasar

  • Quasar payload

  • Orcurs Rat Executable

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Windows security modification

    evasiontrojan

  • Adds Run key to start application

    persistence
  behavioral1behavioral2