Malware Analysis Report

2025-03-15 06:49

Sample ID 240106-bggtdafae2
Target 509cfaac45f23bf4bba6fd9f0a631d483d44c04930eeb5a3e68f3badcbd9bba0
SHA256 509cfaac45f23bf4bba6fd9f0a631d483d44c04930eeb5a3e68f3badcbd9bba0
Tags
orcus persistence rat spyware stealer
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

509cfaac45f23bf4bba6fd9f0a631d483d44c04930eeb5a3e68f3badcbd9bba0

Threat Level: Known bad

The file 509cfaac45f23bf4bba6fd9f0a631d483d44c04930eeb5a3e68f3badcbd9bba0 was found to be: Known bad.

Malicious Activity Summary

orcus persistence rat spyware stealer

Orcurs Rat Executable

Orcus main payload

Orcus family

Orcus

Orcurs Rat Executable

Loads dropped DLL

Executes dropped EXE

Adds Run key to start application

Drops file in System32 directory

Drops file in Program Files directory

Unsigned PE

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

Uses Task Scheduler COM API

Suspicious use of SetWindowsHookEx

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-01-06 01:06

Signatures

Orcurs Rat Executable

Description Indicator Process Target
N/A N/A N/A N/A

Orcus family

orcus

Orcus main payload

Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-01-06 01:06

Reported

2024-01-06 01:09

Platform

win7-20231129-en

Max time kernel

149s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\509cfaac45f23bf4bba6fd9f0a631d483d44c04930eeb5a3e68f3badcbd9bba0.exe"

Signatures

Orcus

rat spyware stealer orcus

Orcurs Rat Executable

Description Indicator Process Target
N/A N/A N/A N/A

Loads dropped DLL

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\java.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3470981204-343661084-3367201002-1000\Software\Microsoft\Windows\CurrentVersion\Run\explorer = "\"C:\\Program Files\\Orcus\\Orcus.exe\"" C:\Program Files\Orcus\Orcus.exe N/A

Drops file in System32 directory

Description Indicator Process Target
File created C:\Windows\SysWOW64\WindowsInput.exe C:\Users\Admin\AppData\Local\Temp\509cfaac45f23bf4bba6fd9f0a631d483d44c04930eeb5a3e68f3badcbd9bba0.exe N/A
File created C:\Windows\SysWOW64\WindowsInput.exe.config C:\Users\Admin\AppData\Local\Temp\509cfaac45f23bf4bba6fd9f0a631d483d44c04930eeb5a3e68f3badcbd9bba0.exe N/A
File created C:\Windows\SysWOW64\WindowsInput.InstallState C:\Windows\SysWOW64\WindowsInput.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File created C:\Program Files\Orcus\Orcus.exe C:\Users\Admin\AppData\Local\Temp\509cfaac45f23bf4bba6fd9f0a631d483d44c04930eeb5a3e68f3badcbd9bba0.exe N/A
File opened for modification C:\Program Files\Orcus\Orcus.exe C:\Users\Admin\AppData\Local\Temp\509cfaac45f23bf4bba6fd9f0a631d483d44c04930eeb5a3e68f3badcbd9bba0.exe N/A
File created C:\Program Files\Orcus\Orcus.exe.config C:\Users\Admin\AppData\Local\Temp\509cfaac45f23bf4bba6fd9f0a631d483d44c04930eeb5a3e68f3badcbd9bba0.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\java.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\java.exe N/A
N/A N/A C:\Program Files\Orcus\Orcus.exe N/A
N/A N/A C:\Program Files\Orcus\Orcus.exe N/A
N/A N/A C:\Program Files\Orcus\Orcus.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\java.exe N/A
N/A N/A C:\Program Files\Orcus\Orcus.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\java.exe N/A
N/A N/A C:\Program Files\Orcus\Orcus.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\java.exe N/A
N/A N/A C:\Program Files\Orcus\Orcus.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\java.exe N/A
N/A N/A C:\Program Files\Orcus\Orcus.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\java.exe N/A
N/A N/A C:\Program Files\Orcus\Orcus.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\java.exe N/A
N/A N/A C:\Program Files\Orcus\Orcus.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\java.exe N/A
N/A N/A C:\Program Files\Orcus\Orcus.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\java.exe N/A
N/A N/A C:\Program Files\Orcus\Orcus.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\java.exe N/A
N/A N/A C:\Program Files\Orcus\Orcus.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\java.exe N/A
N/A N/A C:\Program Files\Orcus\Orcus.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\java.exe N/A
N/A N/A C:\Program Files\Orcus\Orcus.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\java.exe N/A
N/A N/A C:\Program Files\Orcus\Orcus.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\java.exe N/A
N/A N/A C:\Program Files\Orcus\Orcus.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\java.exe N/A
N/A N/A C:\Program Files\Orcus\Orcus.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\java.exe N/A
N/A N/A C:\Program Files\Orcus\Orcus.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\java.exe N/A
N/A N/A C:\Program Files\Orcus\Orcus.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\java.exe N/A
N/A N/A C:\Program Files\Orcus\Orcus.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\java.exe N/A
N/A N/A C:\Program Files\Orcus\Orcus.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\java.exe N/A
N/A N/A C:\Program Files\Orcus\Orcus.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\java.exe N/A
N/A N/A C:\Program Files\Orcus\Orcus.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\java.exe N/A
N/A N/A C:\Program Files\Orcus\Orcus.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\java.exe N/A
N/A N/A C:\Program Files\Orcus\Orcus.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\java.exe N/A
N/A N/A C:\Program Files\Orcus\Orcus.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\java.exe N/A
N/A N/A C:\Program Files\Orcus\Orcus.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\java.exe N/A
N/A N/A C:\Program Files\Orcus\Orcus.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\java.exe N/A
N/A N/A C:\Program Files\Orcus\Orcus.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\java.exe N/A
N/A N/A C:\Program Files\Orcus\Orcus.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\java.exe N/A
N/A N/A C:\Program Files\Orcus\Orcus.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\java.exe N/A
N/A N/A C:\Program Files\Orcus\Orcus.exe N/A
N/A N/A C:\Users\Admin\AppData\Roaming\java.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Program Files\Orcus\Orcus.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\java.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\java.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Program Files\Orcus\Orcus.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2908 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\509cfaac45f23bf4bba6fd9f0a631d483d44c04930eeb5a3e68f3badcbd9bba0.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
PID 2908 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\509cfaac45f23bf4bba6fd9f0a631d483d44c04930eeb5a3e68f3badcbd9bba0.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
PID 2908 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\509cfaac45f23bf4bba6fd9f0a631d483d44c04930eeb5a3e68f3badcbd9bba0.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
PID 2416 wrote to memory of 960 N/A C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 2416 wrote to memory of 960 N/A C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 2416 wrote to memory of 960 N/A C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
PID 2908 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Local\Temp\509cfaac45f23bf4bba6fd9f0a631d483d44c04930eeb5a3e68f3badcbd9bba0.exe C:\Windows\SysWOW64\WindowsInput.exe
PID 2908 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Local\Temp\509cfaac45f23bf4bba6fd9f0a631d483d44c04930eeb5a3e68f3badcbd9bba0.exe C:\Windows\SysWOW64\WindowsInput.exe
PID 2908 wrote to memory of 2864 N/A C:\Users\Admin\AppData\Local\Temp\509cfaac45f23bf4bba6fd9f0a631d483d44c04930eeb5a3e68f3badcbd9bba0.exe C:\Windows\SysWOW64\WindowsInput.exe
PID 2908 wrote to memory of 3040 N/A C:\Users\Admin\AppData\Local\Temp\509cfaac45f23bf4bba6fd9f0a631d483d44c04930eeb5a3e68f3badcbd9bba0.exe C:\Program Files\Orcus\Orcus.exe
PID 2908 wrote to memory of 3040 N/A C:\Users\Admin\AppData\Local\Temp\509cfaac45f23bf4bba6fd9f0a631d483d44c04930eeb5a3e68f3badcbd9bba0.exe C:\Program Files\Orcus\Orcus.exe
PID 2908 wrote to memory of 3040 N/A C:\Users\Admin\AppData\Local\Temp\509cfaac45f23bf4bba6fd9f0a631d483d44c04930eeb5a3e68f3badcbd9bba0.exe C:\Program Files\Orcus\Orcus.exe
PID 2180 wrote to memory of 2776 N/A C:\Windows\system32\taskeng.exe C:\Program Files\Orcus\Orcus.exe
PID 2180 wrote to memory of 2776 N/A C:\Windows\system32\taskeng.exe C:\Program Files\Orcus\Orcus.exe
PID 2180 wrote to memory of 2776 N/A C:\Windows\system32\taskeng.exe C:\Program Files\Orcus\Orcus.exe
PID 3040 wrote to memory of 1528 N/A C:\Program Files\Orcus\Orcus.exe C:\Users\Admin\AppData\Roaming\java.exe
PID 3040 wrote to memory of 1528 N/A C:\Program Files\Orcus\Orcus.exe C:\Users\Admin\AppData\Roaming\java.exe
PID 3040 wrote to memory of 1528 N/A C:\Program Files\Orcus\Orcus.exe C:\Users\Admin\AppData\Roaming\java.exe
PID 3040 wrote to memory of 1528 N/A C:\Program Files\Orcus\Orcus.exe C:\Users\Admin\AppData\Roaming\java.exe
PID 3040 wrote to memory of 1528 N/A C:\Program Files\Orcus\Orcus.exe C:\Users\Admin\AppData\Roaming\java.exe
PID 3040 wrote to memory of 1528 N/A C:\Program Files\Orcus\Orcus.exe C:\Users\Admin\AppData\Roaming\java.exe
PID 3040 wrote to memory of 1528 N/A C:\Program Files\Orcus\Orcus.exe C:\Users\Admin\AppData\Roaming\java.exe
PID 1528 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Roaming\java.exe C:\Users\Admin\AppData\Roaming\java.exe
PID 1528 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Roaming\java.exe C:\Users\Admin\AppData\Roaming\java.exe
PID 1528 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Roaming\java.exe C:\Users\Admin\AppData\Roaming\java.exe
PID 1528 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Roaming\java.exe C:\Users\Admin\AppData\Roaming\java.exe
PID 1528 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Roaming\java.exe C:\Users\Admin\AppData\Roaming\java.exe
PID 1528 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Roaming\java.exe C:\Users\Admin\AppData\Roaming\java.exe
PID 1528 wrote to memory of 2984 N/A C:\Users\Admin\AppData\Roaming\java.exe C:\Users\Admin\AppData\Roaming\java.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\509cfaac45f23bf4bba6fd9f0a631d483d44c04930eeb5a3e68f3badcbd9bba0.exe

"C:\Users\Admin\AppData\Local\Temp\509cfaac45f23bf4bba6fd9f0a631d483d44c04930eeb5a3e68f3badcbd9bba0.exe"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\76shxxts.cmdline"

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES81D.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC81C.tmp"

C:\Windows\SysWOW64\WindowsInput.exe

"C:\Windows\SysWOW64\WindowsInput.exe" --install

C:\Windows\SysWOW64\WindowsInput.exe

"C:\Windows\SysWOW64\WindowsInput.exe"

C:\Program Files\Orcus\Orcus.exe

"C:\Program Files\Orcus\Orcus.exe"

C:\Program Files\Orcus\Orcus.exe

"C:\Program Files\Orcus\Orcus.exe"

C:\Users\Admin\AppData\Roaming\java.exe

"C:\Users\Admin\AppData\Roaming\java.exe" /launchSelfAndExit "C:\Program Files\Orcus\Orcus.exe" 3040 /protectFile

C:\Users\Admin\AppData\Roaming\java.exe

"C:\Users\Admin\AppData\Roaming\java.exe" /watchProcess "C:\Program Files\Orcus\Orcus.exe" 3040 "/protectFile"

C:\Windows\system32\taskeng.exe

taskeng.exe {EAFDFA8A-6FD6-4A2E-A43F-26FCDEC229F2} S-1-5-21-3470981204-343661084-3367201002-1000:GLTGRJAG\Admin:Interactive:[1]

Network

Country Destination Domain Proto
N/A 10.0.2.15:4444 tcp
N/A 10.0.2.15:4444 tcp
N/A 10.0.2.15:4444 tcp
N/A 10.0.2.15:4444 tcp
N/A 10.0.2.15:4444 tcp
N/A 10.0.2.15:4444 tcp
N/A 10.0.2.15:4444 tcp
N/A 10.0.2.15:4444 tcp
N/A 10.0.2.15:4444 tcp
N/A 10.0.2.15:4444 tcp
N/A 10.0.2.15:4444 tcp
N/A 10.0.2.15:4444 tcp

Files

memory/2908-0-0x0000000000A40000-0x0000000000A9C000-memory.dmp

memory/2908-1-0x0000000000410000-0x000000000041E000-memory.dmp

memory/2908-2-0x000007FEF5CD0000-0x000007FEF666D000-memory.dmp

memory/2908-3-0x0000000000AF0000-0x0000000000B70000-memory.dmp

memory/2416-10-0x0000000002260000-0x00000000022E0000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\RES81D.tmp

MD5 e51a2a1102175a33176bcde6a933eea2
SHA1 3f691078c1f03e01c48e096002d8ccc000967503
SHA256 6a1cd6214f81d0bc822bae52829e777715244493bfd516cabd5695747d07500f
SHA512 11389b4cd234ec061d816cc6f1f3969919a2a27dd2421da25f4ad8e44640147904068e18a524f2f2c243b29f5bb0962e39eae8f5324a2e461db8ba03109665ef

memory/2908-18-0x0000000000AA0000-0x0000000000AB6000-memory.dmp

memory/2908-21-0x00000000009F0000-0x00000000009F8000-memory.dmp

memory/2908-22-0x0000000000A20000-0x0000000000A28000-memory.dmp

memory/2908-20-0x0000000000440000-0x0000000000452000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\76shxxts.dll

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

\??\c:\Users\Admin\AppData\Local\Temp\CSC81C.tmp

MD5 e347f080350d2dad32fa1d0b4ba54534
SHA1 76ca812a4b85a41401ceb3efc2ce372424132bf2
SHA256 759f726f469ad978ceff29e9952a50004db4efc983d7a92b2eab77e48fc6381a
SHA512 a7a8d65872d955a20dff0da2c2c46c9366d647339608afe912756c193c9a7abdd10ccb81609d5f9b178df5aece29109b04c6f0629d52dc87a227b1f3aa3549bf

\??\c:\Users\Admin\AppData\Local\Temp\76shxxts.0.cs

MD5 6011503497b1b9250a05debf9690e52c
SHA1 897aea61e9bffc82d7031f1b3da12fb83efc6d82
SHA256 08f42b8d57bb61bc8f9628c8a80953b06ca4149d50108083fca6dc26bdd49434
SHA512 604c33e82e8b5bb5c54389c2899c81e5482a06e69db08268173a5b4574327ee5de656d312011d07e50a2e398a4c9b0cd79029013f76e05e18cf67ce5a916ffd9

memory/2908-26-0x0000000000AF0000-0x0000000000B70000-memory.dmp

memory/2864-32-0x00000000009C0000-0x00000000009CC000-memory.dmp

memory/2864-33-0x000007FEED900000-0x000007FEEE2EC000-memory.dmp

\??\c:\Users\Admin\AppData\Local\Temp\76shxxts.cmdline

MD5 d17b3bf59f9795cb220fdf3ebd53a0a0
SHA1 a9ed88cdb10e2e4053a8944dd5a189928623e56a
SHA256 c86f7d1966802f70356b8bb87ddcf7d7dece2efb3e4b20409e8a854ef05c8229
SHA512 b135ad2e2f16997673fa146ea9dd72ea0cb808f690b713084eac3e394c1b67096da91f2d6d4261f871c05fbd6d5b18f3a4f35ca3c6ce373222f9efef4371c5bb

memory/2908-4-0x000007FEF5CD0000-0x000007FEF666D000-memory.dmp

memory/2580-38-0x00000000000A0000-0x00000000000AC000-memory.dmp

memory/2580-39-0x000007FEECF10000-0x000007FEED8FC000-memory.dmp

memory/2864-36-0x000007FEED900000-0x000007FEEE2EC000-memory.dmp

memory/3040-50-0x000007FEECF10000-0x000007FEED8FC000-memory.dmp

memory/3040-51-0x00000000023D0000-0x0000000002450000-memory.dmp

memory/2908-49-0x000007FEF5CD0000-0x000007FEF666D000-memory.dmp

memory/3040-48-0x0000000000960000-0x0000000000A4E000-memory.dmp

memory/3040-54-0x00000000020F0000-0x000000000213E000-memory.dmp

memory/3040-55-0x0000000002350000-0x0000000002368000-memory.dmp

memory/3040-56-0x0000000002380000-0x0000000002390000-memory.dmp

memory/3040-58-0x00000000023D0000-0x0000000002450000-memory.dmp

memory/1528-69-0x0000000001200000-0x0000000001208000-memory.dmp

memory/1528-70-0x0000000074B60000-0x000000007524E000-memory.dmp

memory/2984-74-0x0000000074B60000-0x000000007524E000-memory.dmp

memory/1528-73-0x0000000074B60000-0x000000007524E000-memory.dmp

memory/2776-65-0x000000001AE10000-0x000000001AE90000-memory.dmp

memory/2776-62-0x000007FEECF10000-0x000007FEED8FC000-memory.dmp

memory/2776-75-0x000007FEECF10000-0x000007FEED8FC000-memory.dmp

memory/2580-76-0x000007FEECF10000-0x000007FEED8FC000-memory.dmp

memory/3040-77-0x000007FEECF10000-0x000007FEED8FC000-memory.dmp

memory/3040-78-0x00000000023D0000-0x0000000002450000-memory.dmp

memory/3040-79-0x00000000023D0000-0x0000000002450000-memory.dmp

memory/2984-80-0x0000000074B60000-0x000000007524E000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-01-06 01:06

Reported

2024-01-06 01:09

Platform

win10v2004-20231222-en

Command Line

N/A

Signatures

N/A

Processes

N/A

Network

N/A

Files

N/A