General
-
Target
7d0f79a9febca115226349613a122d06c83e4fc9b8d955e6cc7654bad357ff9e
-
Size
1.2MB
-
Sample
241227-bdkqvsxlay
-
MD5
d66d5168a0fb7326e23963f4e8502e32
-
SHA1
8e5d448ff498a01afc000f9be8a3d5a6591c2a9a
-
SHA256
7d0f79a9febca115226349613a122d06c83e4fc9b8d955e6cc7654bad357ff9e
-
SHA512
5a06b4c83cdee5ff2d6b7c914a021c8e7f43370f2ee3a63d376fbf568648a162098b956d3eb1fe9cf5920c269868f40fc0dc43f73ac7413039eea71056a9eb19
-
SSDEEP
24576:e6xS04YNEMuExDiU6E5R9s8xY/2l/dIJ5dtsPxNGfeLbB83lIbt+rG:e6z4auS+UjfU2TM5XDEb63lIbt+r
Malware Config
Extracted
orcus
another-contains.gl.at.ply.gg
a49af69032c94d6fa7c0d2639d32f038
-
administration_rights_required
false
-
anti_debugger
false
-
anti_tcp_analyzer
false
-
antivm
false
-
autostart_method
1
-
change_creation_date
false
-
force_installer_administrator_privileges
false
-
hide_file
false
-
install
false
-
installation_folder
%appdata%\Microsoft\Speech\AudioDriver.exe
-
installservice
false
-
keylogger_enabled
false
-
newcreationdate
12/24/2024 02:03:43
-
plugins
AgUFyOzBvwKV1wLetwKoxrcNilV/bBUKRwBhAG0AZQByACAAVgBpAGUAdwAHAzEALgAyAEEgYgA2ADkAZgA0ADUAZQBiADYANgAxADYANAA2ADAAZgA5AGUAMQAwADIAMgBkADcANwA3ADMAMABmADAANwAzAAIAAAACAg==
-
reconnect_delay
10000
-
registry_autostart_keyname
Audio HD Driver
-
registry_hidden_autostart
false
-
set_admin_flag
false
-
tasksch_name
Audio HD Driver
-
tasksch_request_highest_privileges
false
-
try_other_autostart_onfail
false
Targets
-
-
Target
7d0f79a9febca115226349613a122d06c83e4fc9b8d955e6cc7654bad357ff9e
-
Size
1.2MB
-
MD5
d66d5168a0fb7326e23963f4e8502e32
-
SHA1
8e5d448ff498a01afc000f9be8a3d5a6591c2a9a
-
SHA256
7d0f79a9febca115226349613a122d06c83e4fc9b8d955e6cc7654bad357ff9e
-
SHA512
5a06b4c83cdee5ff2d6b7c914a021c8e7f43370f2ee3a63d376fbf568648a162098b956d3eb1fe9cf5920c269868f40fc0dc43f73ac7413039eea71056a9eb19
-
SSDEEP
24576:e6xS04YNEMuExDiU6E5R9s8xY/2l/dIJ5dtsPxNGfeLbB83lIbt+rG:e6z4auS+UjfU2TM5XDEb63lIbt+r
Score10/10-
Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
-
Orcus family
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-