General
-
Target
7acde10336ba1e4e9b6d9cfbf7c3fba0cc4aacf3762d2cff996409f9c201c79e
-
Size
918KB
-
Sample
240422-bgzn7add34
-
MD5
de8e68b535ec5e52cf9869f8da859b51
-
SHA1
5dbbaff2683785332ba1efa276865d6f874d0e1b
-
SHA256
7acde10336ba1e4e9b6d9cfbf7c3fba0cc4aacf3762d2cff996409f9c201c79e
-
SHA512
8f5b291c889d66222bef4bdefa846315ef37f8139271ea9a89bc6296955109fed10a90e65fb6bfe8168e78d14262066bc769adf5cdc15fc996af039dba196ef4
-
SSDEEP
24576:fVQg4MROxnFD3irXYf1rrcI0AilFEvxHP+ooU:dmMiJ/rrcI0AilFEvxHP
Malware Config
Extracted
orcus
127.0.0.1:10134
316bd05012dc47dcafa9a06af7241f8a
-
autostart_method
Registry
-
enable_keylogger
true
-
install_path
%programfiles%\Windows Defender
-
reconnect_delay
10000
-
registry_keyname
Windows Realtek Audio Driver
-
taskscheduler_taskname
Windows Realtek Audio Driver
-
watchdog_path
Temp\Windows Realtek Audio Driver.exe
Targets
-
-
Target
7acde10336ba1e4e9b6d9cfbf7c3fba0cc4aacf3762d2cff996409f9c201c79e
-
Size
918KB
-
MD5
de8e68b535ec5e52cf9869f8da859b51
-
SHA1
5dbbaff2683785332ba1efa276865d6f874d0e1b
-
SHA256
7acde10336ba1e4e9b6d9cfbf7c3fba0cc4aacf3762d2cff996409f9c201c79e
-
SHA512
8f5b291c889d66222bef4bdefa846315ef37f8139271ea9a89bc6296955109fed10a90e65fb6bfe8168e78d14262066bc769adf5cdc15fc996af039dba196ef4
-
SSDEEP
24576:fVQg4MROxnFD3irXYf1rrcI0AilFEvxHP+ooU:dmMiJ/rrcI0AilFEvxHP
Score10/10-
Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
-
Orcurs Rat Executable
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Drops file in System32 directory
-