Overview

overview

10

Static

static

10

b2b799de79...17.exe

windows7-x64

10

b2b799de79...17.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b2b799de79ae7073d1f92584000e7de9ac6ce223e1e1123b6960297df857dc17

  • Size

    2.3MB

  • MD5

    640810384369b5434037b059e178d2cb

  • SHA1

    67f0e5c4df09a2f6fe86574f681569e3d2bd8879

  • SHA256

    b2b799de79ae7073d1f92584000e7de9ac6ce223e1e1123b6960297df857dc17

  • SHA512

    b504a544392c24adb40fa75756470e47cf03b921f2c0bff7f24e3af3a58a6ef2d754a6149fbaba643b1c78d05c31896172863dcd2f4d33d0bf49c46240c81958

  • SSDEEP

    49152:y4AMirXrrcI0AilFEvxHPLPUwXNYSLNTdqjy6:y4AtUwc

Score
10/10
orcusquasar

Malware Config

Signatures

  • Contains code to disable Windows Defender 1 IoCs

    A .NET executable tasked with disabling Windows Defender capabilities such as realtime monitoring, blocking at first seen, etc.

  • Orcurs Rat Executable 1 IoCs
  • Orcus family
    orcus
  • Orcus main payload 1 IoCs
  • Quasar family
    quasar
  • Quasar payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • b2b799de79ae7073d1f92584000e7de9ac6ce223e1e1123b6960297df857dc17
    .exe windows:5 windows x86 arch:x86

    9222d372923baed7aa9dfa28449a94ea


    Headers

    Imports

    Sections