General
-
Target
c5c447a6588773bd4c9f8c9a078663b0b3f6d4c2036d1c2b983a39bca74c2775
-
Size
15.9MB
-
Sample
241125-bsa5zazrgx
-
MD5
13c37f5336c5b01da8a841d5d5ea5329
-
SHA1
8db6b841dda79c0deb73f2a98ad0f331566afd38
-
SHA256
c5c447a6588773bd4c9f8c9a078663b0b3f6d4c2036d1c2b983a39bca74c2775
-
SHA512
1228b8bd532604621abc5aa1e51cd3a29d3c4b79c2e113d366e9276ffb8af98b61f97eda459468d23ef41ff14ae1d8e96627d86b43bab540bcf2fcb8a1435cd7
-
SSDEEP
24576:tDPS04YNEMuExDiU6E5R9s8xY/2l/dVBFIbt+roULW:tDl4auS+UjfU2T3FIbt+rBLW
Malware Config
Extracted
orcus
147.185.221.23
communications-sugar.gl.at.ply.gg
fa092d2d504a432b8068a82704f07227
-
administration_rights_required
false
-
anti_debugger
false
-
anti_tcp_analyzer
false
-
antivm
false
-
autostart_method
1
-
change_creation_date
false
-
force_installer_administrator_privileges
false
-
hide_file
false
-
install
false
-
installation_folder
%appdata%\Microsoft\Speech\AudioDriver.exe
-
installservice
false
-
keylogger_enabled
false
-
newcreationdate
11/18/2024 13:11:11
-
plugins
AgUFyfihswTdIPqEArukcmEdSF06Hw9CAFMAbwBEACAAUAByAG8AdABlAGMAdABpAG8AbgAHAzEALgAwAEEgNQA3ADEANwA3AGYAOQA2ADUANABhADAANAA2ADQANQA5ADgAZgBhADgANQA0ADMAZgAyAGIAYgAyADYANgA5AAEFl6aNkQPXkQKOmwKLvFcpr24sKCsVRABpAHMAYQBiAGwAZQAgAFcAZQBiAGMAYQBtACAATABpAGcAaAB0AHMABwMxAC4AMABBIDQAYwA4ADcAOQA3ADAAZQAzADUAMwA4ADQAOQBkAGIAYQBjADkAMgBhAGIAYQAxAGUAMwBmADgAYgBkADIAMQABAAAEBA==
-
reconnect_delay
10000
-
registry_autostart_keyname
Audio HD Driver
-
registry_hidden_autostart
false
-
set_admin_flag
false
-
tasksch_name
Audio HD Driver
-
tasksch_request_highest_privileges
false
-
try_other_autostart_onfail
false
Targets
-
-
Target
c5c447a6588773bd4c9f8c9a078663b0b3f6d4c2036d1c2b983a39bca74c2775
-
Size
15.9MB
-
MD5
13c37f5336c5b01da8a841d5d5ea5329
-
SHA1
8db6b841dda79c0deb73f2a98ad0f331566afd38
-
SHA256
c5c447a6588773bd4c9f8c9a078663b0b3f6d4c2036d1c2b983a39bca74c2775
-
SHA512
1228b8bd532604621abc5aa1e51cd3a29d3c4b79c2e113d366e9276ffb8af98b61f97eda459468d23ef41ff14ae1d8e96627d86b43bab540bcf2fcb8a1435cd7
-
SSDEEP
24576:tDPS04YNEMuExDiU6E5R9s8xY/2l/dVBFIbt+roULW:tDl4auS+UjfU2T3FIbt+rBLW
Score10/10-
Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
-
Orcus family
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-