General
-
Target
da6cc38febbd89b0276aaa39e43ca4beae18db2563d3954958d09c7ce07d15b8
-
Size
1.0MB
-
Sample
241125-bj2lkazmd1
-
MD5
6af52570404e4ba88d83c268bb9da934
-
SHA1
85765f1305efa0554c1624cdbcae3f91239a6a66
-
SHA256
da6cc38febbd89b0276aaa39e43ca4beae18db2563d3954958d09c7ce07d15b8
-
SHA512
5f3d2dbf8ee361ada96ee2c91f9b35397b3c5e692cb2bbf88b103b6c352c232622077e73847070c14418ed4c8689a6ae956ddedd6bd70b8cab702a795d5f6d2f
-
SSDEEP
24576:4DPS04YNEMuExDiU6E5R9s8xY/2l/dVB8Ibt+rYhmpnncVy:4Dl4auS+UjfU2T38Ibt+rbpnoy
Malware Config
Extracted
orcus
147.185.221.23
communications-sugar.gl.at.ply.gg
d031b9dd54b940159425126d47f2c06a
-
administration_rights_required
false
-
anti_debugger
false
-
anti_tcp_analyzer
false
-
antivm
false
-
autostart_method
1
-
change_creation_date
false
-
force_installer_administrator_privileges
false
-
hide_file
false
-
install
false
-
installation_folder
%appdata%\Microsoft\Speech\AudioDriver.exe
-
installservice
false
-
keylogger_enabled
false
-
newcreationdate
11/18/2024 13:11:11
-
plugins
AgUFyfihswTdIPqEArukcmEdSF06Hw9CAFMAbwBEACAAUAByAG8AdABlAGMAdABpAG8AbgAHAzEALgAwAEEgYQA0ADYAMQA1ADcAYgA2ADYAYgA1AGUANAA1AGEAZQBiADgAMQA1AGYAMgA0AGIAYgAzAGEAOQA3AGIANQA2AAEFl6aNkQPXkQKOmwKLvFcpr24sKCsVRABpAHMAYQBiAGwAZQAgAFcAZQBiAGMAYQBtACAATABpAGcAaAB0AHMABwMxAC4AMABBIDEANgA1ADMANAA1ADcANgBlAGQAZQA5ADQAYgAxADUAYgBiAGQAYQBmAGQAOQBkADEAZAA1ADYAOAAzAGUAZQABAAAEBA==
-
reconnect_delay
10000
-
registry_autostart_keyname
Audio HD Driver
-
registry_hidden_autostart
false
-
set_admin_flag
false
-
tasksch_name
Audio HD Driver
-
tasksch_request_highest_privileges
false
-
try_other_autostart_onfail
false
Targets
-
-
Target
da6cc38febbd89b0276aaa39e43ca4beae18db2563d3954958d09c7ce07d15b8
-
Size
1.0MB
-
MD5
6af52570404e4ba88d83c268bb9da934
-
SHA1
85765f1305efa0554c1624cdbcae3f91239a6a66
-
SHA256
da6cc38febbd89b0276aaa39e43ca4beae18db2563d3954958d09c7ce07d15b8
-
SHA512
5f3d2dbf8ee361ada96ee2c91f9b35397b3c5e692cb2bbf88b103b6c352c232622077e73847070c14418ed4c8689a6ae956ddedd6bd70b8cab702a795d5f6d2f
-
SSDEEP
24576:4DPS04YNEMuExDiU6E5R9s8xY/2l/dVB8Ibt+rYhmpnncVy:4Dl4auS+UjfU2T38Ibt+rbpnoy
Score10/10-
Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
-
Orcus family
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-