General
-
Target
20980da93a018ee5e8d8eb95bb21620244c4a7e56c92d8fc657f3fa9c58e4132
-
Size
5.0MB
-
Sample
241207-bez7yatkej
-
MD5
b4df4594ac31598703ab5e52af43d8fd
-
SHA1
89bee8739fefe1e10ba55dadbb0a17d83576eec4
-
SHA256
20980da93a018ee5e8d8eb95bb21620244c4a7e56c92d8fc657f3fa9c58e4132
-
SHA512
fe9983d88a855b4cbf4746c9b5cc197ca335d94246fdc86d09b7e2f369fa8e95bb6fe4101e51648e7dfb6b7afc02b59fd42c4bfa2498d1372a31ca01c439db19
-
SSDEEP
24576:eEu4MROxnFe3idtrrcI0AilFEvxHPfmooN:eIMiwkrrcI0AilFEvxHP
Behavioral task
behavioral1
Sample
20980da93a018ee5e8d8eb95bb21620244c4a7e56c92d8fc657f3fa9c58e4132.exe
Resource
win7-20240903-en
Malware Config
Extracted
orcus
Test Hack
127.0.0.1:10134
de4e6099f84e48d89e40ea74092aa6a9
-
autostart_method
Registry
-
enable_keylogger
true
-
install_path
%programfiles%\HDAudioDriver\HDAudioDriver.exe
-
reconnect_delay
10000
-
registry_keyname
Realtek_audio_driver
-
taskscheduler_taskname
Orcus
-
watchdog_path
Temp\chrome.exe
Targets
-
-
Target
20980da93a018ee5e8d8eb95bb21620244c4a7e56c92d8fc657f3fa9c58e4132
-
Size
5.0MB
-
MD5
b4df4594ac31598703ab5e52af43d8fd
-
SHA1
89bee8739fefe1e10ba55dadbb0a17d83576eec4
-
SHA256
20980da93a018ee5e8d8eb95bb21620244c4a7e56c92d8fc657f3fa9c58e4132
-
SHA512
fe9983d88a855b4cbf4746c9b5cc197ca335d94246fdc86d09b7e2f369fa8e95bb6fe4101e51648e7dfb6b7afc02b59fd42c4bfa2498d1372a31ca01c439db19
-
SSDEEP
24576:eEu4MROxnFe3idtrrcI0AilFEvxHPfmooN:eIMiwkrrcI0AilFEvxHP
-
Orcus family
-
Orcus main payload
-
Orcurs Rat Executable
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-