General
-
Target
f8f9b67a999d352eb4878beebd5b10e93d49b78fa85cdc3082c49b6d90ebf273
-
Size
1.2MB
-
Sample
241223-bh6twssrf1
-
MD5
1f39db8be8233256490ea622307596f9
-
SHA1
956cdfe145a361e42f593dd9435fe4b3e30345a8
-
SHA256
f8f9b67a999d352eb4878beebd5b10e93d49b78fa85cdc3082c49b6d90ebf273
-
SHA512
e0cfb9bb12e4883af1222a2f03afb52ba53612984456f5d430591e93c22dbe8fad3b843b7ca5d3f7c9f36542ba7d51f8fa8dc3e8db69ddd744b8e3a21576f02c
-
SSDEEP
24576:Q9qPS04YNEMuExDiU6E5R9s8xY/2l/dRJ5dtsPxNGfn26Ibt+ru:Q9ql4auS+UjfU2T/5XD+6Ibt+r
Behavioral task
behavioral1
Sample
f8f9b67a999d352eb4878beebd5b10e93d49b78fa85cdc3082c49b6d90ebf273.exe
Resource
win7-20241010-en
Malware Config
Extracted
orcus
192.168.1.20
d9d8c363f70246259b2e54128bb893c3
-
administration_rights_required
false
-
anti_debugger
false
-
anti_tcp_analyzer
false
-
antivm
false
-
autostart_method
1
-
change_creation_date
false
-
force_installer_administrator_privileges
false
-
hide_file
false
-
install
false
-
installation_folder
%appdata%\Microsoft\Speech\AudioDriver.exe
-
installservice
false
-
keylogger_enabled
false
-
newcreationdate
12/22/2024 12:37:50
-
plugins
AgUFyfihswTdIPqEArukcmEdSF06Hw9CAFMAbwBEACAAUAByAG8AdABlAGMAdABpAG8AbgAHAzEALgAwAEEgZgAxADYAMwBjAGIANwA4ADkAMwAzADEANAAzADUAYgBhADMAOQBkAGUAZQBkAGIAYgBjADEANQBmADcANQA5AAEFl6aNkQPXkQKOmwKLvFcpr24sKCsVRABpAHMAYQBiAGwAZQAgAFcAZQBiAGMAYQBtACAATABpAGcAaAB0AHMABwMxAC4AMABBIDcAMgAwAGIAZAA1AGUANABjADcAZgBmADQANQA3AGMAYQBhADEAZgA5ADQAZABhAGEANgA1ADEAYgA5ADcAMQABBcjswb8CldcC3rcCqMa3DYpVf2wVCkcAYQBtAGUAcgAgAFYAaQBlAHcABwMxAC4AMgBBIGYANwAyAGIAZgA3AGMANABjADYAZAA0ADQAMQBjADkAYgA2AGUAMgBmADcAMAA4ADYANQA4AGMANAA5ADkAYgACAAYG
-
reconnect_delay
10000
-
registry_autostart_keyname
Audio HD Driver
-
registry_hidden_autostart
false
-
set_admin_flag
false
-
tasksch_name
Audio HD Driver
-
tasksch_request_highest_privileges
false
-
try_other_autostart_onfail
false
Targets
-
-
Target
f8f9b67a999d352eb4878beebd5b10e93d49b78fa85cdc3082c49b6d90ebf273
-
Size
1.2MB
-
MD5
1f39db8be8233256490ea622307596f9
-
SHA1
956cdfe145a361e42f593dd9435fe4b3e30345a8
-
SHA256
f8f9b67a999d352eb4878beebd5b10e93d49b78fa85cdc3082c49b6d90ebf273
-
SHA512
e0cfb9bb12e4883af1222a2f03afb52ba53612984456f5d430591e93c22dbe8fad3b843b7ca5d3f7c9f36542ba7d51f8fa8dc3e8db69ddd744b8e3a21576f02c
-
SSDEEP
24576:Q9qPS04YNEMuExDiU6E5R9s8xY/2l/dRJ5dtsPxNGfn26Ibt+ru:Q9ql4auS+UjfU2T/5XD+6Ibt+r
-
Orcus family
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-