General
-
Target
yeah.exe
-
Size
1.2MB
-
MD5
f6457e923b3daa5ba6036b78c0b18169
-
SHA1
fe4b8223233fe3ea9f33629c29326daba3cd0d97
-
SHA256
88494e952cf5f51d898c2c19b0926b08a2ec98a20a6876fa687c5f05800fad32
-
SHA512
26222eabbe3b2d157af1e7cad955f089ad52219524abdf2439c2f230696053d2a6925b0f607d41aaaf9c47362ffc30b16ddd331f18ba68ae1804732cafa09388
-
SSDEEP
24576:a5WHS04YNEMuExDiU6E5R9s8xY/2l/dRJ5dtsPxNGfyXIbt+rj:a5Wd4auS+UjfU2T/5XD8Ibt+r
Malware Config
Extracted
orcus
147.185.221.21
75534897aa9340228be565c86ed29b52
-
administration_rights_required
false
-
anti_debugger
false
-
anti_tcp_analyzer
false
-
antivm
false
-
autostart_method
1
-
change_creation_date
false
-
force_installer_administrator_privileges
false
-
hide_file
false
-
install
false
-
installation_folder
%appdata%\Microsoft\Speech\AudioDriver.exe
-
installservice
false
-
keylogger_enabled
false
-
newcreationdate
09/22/2024 20:17:41
-
plugins
AgUFyfihswTdIPqEArukcmEdSF06Hw9CAFMAbwBEACAAUAByAG8AdABlAGMAdABpAG8AbgAHAzEALgAwAEEgMwBiADYAZgA1ADgAMwAxADkAZAA0ADAANAAzAGUAYQBhAGQANgBjADQAMQBmAGQAYQBjAGUAYQA3AGEANAAyAAEFl6aNkQPXkQKOmwKLvFcpr24sKCsVRABpAHMAYQBiAGwAZQAgAFcAZQBiAGMAYQBtACAATABpAGcAaAB0AHMABwMxAC4AMABBIDYAMQA0ADIANgBiADYAMgBkADMAMABiADQAYgA5ADAAOABkADIAYwBmADcAMwA4AGUAYwA3AGUAOQAxAGMAZgABBcjswb8CldcC3rcCqMa3DYpVf2wVCkcAYQBtAGUAcgAgAFYAaQBlAHcABwMxAC4AMgBBIDEAZQAzAGYAYgAzADYAZAAxADgAZAA2ADQANwBlADIAOABlADkANABjAGEAYgAwADcAMQA4ADIAOQAwAGEAZgACAAYG
-
reconnect_delay
10000
-
registry_autostart_keyname
Audio HD Driver
-
registry_hidden_autostart
false
-
set_admin_flag
false
-
tasksch_name
Audio HD Driver
-
tasksch_request_highest_privileges
false
-
try_other_autostart_onfail
false
Signatures
-
Orcus family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
Files
-
yeah.exe
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
Imports
Sections