Overview

overview

10

Static

static

10

example.exe

windows7-x64

10

example.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    example.exe

  • Size

    839KB

  • Sample

    241125-t1qjqswjbw

  • MD5

    351808659677be354200ca26e9b63f5a

  • SHA1

    a147a31f13d21ff0bf0eca9c8dcf20b7cab5e363

  • SHA256

    60d79803c2b81c09f266a57c1e91476d1a5ef4abd3cccc113cd84077398edead

  • SHA512

    c8bcb1278652b76e4825cb4ede51f59790469f17c37b9b75f31c3208d2570c287e9e2dcf17ebd2f406927c558490860bd30b214949a276d66492d6142e125dc8

  • SSDEEP

    24576:UBS04YNEMuExDiU6E5R9s8xY/2l/dGtnIbt+ri:Uj4auS+UjfU2TGdIbt+r

Score
10/10
orcusdiscoveryratspywarestealer

Malware Config

Extracted

Family

orcus

C2

?during-interesting.gl.at.ply.gg

Mutex

7fa8acb6c95d43bf801fe5b284514394

Attributes
  • administration_rights_required

    false

  • anti_debugger

    false

  • anti_tcp_analyzer

    false

  • antivm

    false

  • autostart_method

    1

  • change_creation_date

    false

  • force_installer_administrator_privileges

    false

  • hide_file

    false

  • install

    false

  • installation_folder

    %appdata%\Microsoft\Speech\AudioDriver.exe

  • installservice

    false

  • keylogger_enabled

    false

  • newcreationdate

    11/25/2024 07:59:32

  • plugins

    AgEAAA==

  • reconnect_delay

    10000

  • registry_autostart_keyname

    Audio HD Driver

  • registry_hidden_autostart

    false

  • set_admin_flag

    false

  • tasksch_name

    Audio HD Driver

  • tasksch_request_highest_privileges

    false

  • try_other_autostart_onfail

    false

aes.plain

Targets

    • Target

      example.exe

    • Size

      839KB

    • MD5

      351808659677be354200ca26e9b63f5a

    • SHA1

      a147a31f13d21ff0bf0eca9c8dcf20b7cab5e363

    • SHA256

      60d79803c2b81c09f266a57c1e91476d1a5ef4abd3cccc113cd84077398edead

    • SHA512

      c8bcb1278652b76e4825cb4ede51f59790469f17c37b9b75f31c3208d2570c287e9e2dcf17ebd2f406927c558490860bd30b214949a276d66492d6142e125dc8

    • SSDEEP

      24576:UBS04YNEMuExDiU6E5R9s8xY/2l/dGtnIbt+ri:Uj4auS+UjfU2TGdIbt+r

    Score
    10/10
    orcusdiscoveryratspywarestealer

    • Orcus

      Orcus is a Remote Access Trojan that is being sold on underground forums.

      ratspywarestealerorcus

    • Orcus family

      orcus

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops desktop.ini file(s)

    • Legitimate hosting services abused for malware hosting/C2

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks