General
-
Target
f462c69fd4c49ef432fee2a0068a9aa697220c8a1c72cafb14356c9114a3fe91
-
Size
846KB
-
Sample
241118-blxematqet
-
MD5
6f72012126cf579d7827db2852a5d3d3
-
SHA1
62aa428de035cdfb003821f813a7460079345c71
-
SHA256
f462c69fd4c49ef432fee2a0068a9aa697220c8a1c72cafb14356c9114a3fe91
-
SHA512
3316b90d31a79fb7f9843f5ef5b735081fc448737cbd864aeba17089c82508fbef01ae3b5555cf05e7882ad5a71bab05c029f5cccf6dd94ce6d3cd515f1da387
-
SSDEEP
24576:NeVS04YNEMuExDiU6E5R9s8xY/2l/dGdIbt+r4:Nen4auS+UjfU2TAIbt+r
Malware Config
Extracted
orcus
7cities-blessed.gl.at.ply.gg
8a028f9932904de190b99b35299f86b4
-
administration_rights_required
false
-
anti_debugger
false
-
anti_tcp_analyzer
false
-
antivm
false
-
autostart_method
1
-
change_creation_date
false
-
force_installer_administrator_privileges
false
-
hide_file
false
-
install
false
-
installation_folder
%appdata%\Microsoft\Speech\AudioDriver.exe
-
installservice
false
-
keylogger_enabled
false
-
newcreationdate
11/17/2024 16:18:35
-
plugins
AgUFyfihswTdIPqEArukcmEdSF06Hw9CAFMAbwBEACAAUAByAG8AdABlAGMAdABpAG8AbgAHAzEALgAwAEEgZQBjAGMANQBkAGIAYQA1ADEAOAA0AGQANAA5AGMAZQBhAGQAZAAyADAAYwA2AGYAZAA0ADgAZgAxADUANwA2AAEFl6aNkQPXkQKOmwKLvFcpr24sKCsVRABpAHMAYQBiAGwAZQAgAFcAZQBiAGMAYQBtACAATABpAGcAaAB0AHMABwMxAC4AMABBIDQANAA1ADcAYQBjAGYANQBiADgAMwA5ADQAZgAyAGQAYQA2ADgANwA4AGUAZABmAGEANABlADQAZQA3ADIAOQABAAAEBA==
-
reconnect_delay
10000
-
registry_autostart_keyname
Audio HD Driver
-
registry_hidden_autostart
false
-
set_admin_flag
false
-
tasksch_name
Audio HD Driver
-
tasksch_request_highest_privileges
false
-
try_other_autostart_onfail
false
Targets
-
-
Target
f462c69fd4c49ef432fee2a0068a9aa697220c8a1c72cafb14356c9114a3fe91
-
Size
846KB
-
MD5
6f72012126cf579d7827db2852a5d3d3
-
SHA1
62aa428de035cdfb003821f813a7460079345c71
-
SHA256
f462c69fd4c49ef432fee2a0068a9aa697220c8a1c72cafb14356c9114a3fe91
-
SHA512
3316b90d31a79fb7f9843f5ef5b735081fc448737cbd864aeba17089c82508fbef01ae3b5555cf05e7882ad5a71bab05c029f5cccf6dd94ce6d3cd515f1da387
-
SSDEEP
24576:NeVS04YNEMuExDiU6E5R9s8xY/2l/dGdIbt+r4:Nen4auS+UjfU2TAIbt+r
Score10/10-
Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
-
Orcus family
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-