Overview

overview

10

Static

static

10

example.exe

windows7-x64

10

example.exe

windows10-2004-x64

7

Sharing

Copy URL
Twitter E-mail

General

  • Target

    example.exe

  • Size

    839KB

  • MD5

    351808659677be354200ca26e9b63f5a

  • SHA1

    a147a31f13d21ff0bf0eca9c8dcf20b7cab5e363

  • SHA256

    60d79803c2b81c09f266a57c1e91476d1a5ef4abd3cccc113cd84077398edead

  • SHA512

    c8bcb1278652b76e4825cb4ede51f59790469f17c37b9b75f31c3208d2570c287e9e2dcf17ebd2f406927c558490860bd30b214949a276d66492d6142e125dc8

  • SSDEEP

    24576:UBS04YNEMuExDiU6E5R9s8xY/2l/dGtnIbt+ri:Uj4auS+UjfU2TGdIbt+r

Score
10/10
ratorcus

Malware Config

Extracted

Family

orcus

C2

?during-interesting.gl.at.ply.gg

Mutex

7fa8acb6c95d43bf801fe5b284514394

Attributes
  • administration_rights_required

    false

  • anti_debugger

    false

  • anti_tcp_analyzer

    false

  • antivm

    false

  • autostart_method

    1

  • change_creation_date

    false

  • force_installer_administrator_privileges

    false

  • hide_file

    false

  • install

    false

  • installation_folder

    %appdata%\Microsoft\Speech\AudioDriver.exe

  • installservice

    false

  • keylogger_enabled

    false

  • newcreationdate

    11/25/2024 07:59:32

  • plugins

    AgEAAA==

  • reconnect_delay

    10000

  • registry_autostart_keyname

    Audio HD Driver

  • registry_hidden_autostart

    false

  • set_admin_flag

    false

  • tasksch_name

    Audio HD Driver

  • tasksch_request_highest_privileges

    false

  • try_other_autostart_onfail

    false

aes.plain

Signatures

  • Orcus family
    orcus
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • example.exe
    .exe windows:4 windows x86 arch:x86

    Password: 1234

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections