orcus | 25bff9d0695d521aab5ecc9da9b36363d8e9440993146ec717f24bbaeb433fe4

General

Target

25bff9d0695d521aab5ecc9da9b36363d8e9440993146ec717f24bbaeb433fe4
Size

1.2MB
MD5

b3186c9da291ac61e162cd7101dd0e9c
SHA1

ffa77325a388b8247cd1c5018e9d6923dd8e0e15
SHA256

25bff9d0695d521aab5ecc9da9b36363d8e9440993146ec717f24bbaeb433fe4
SHA512

7bf146ae618767f61f7569ffa43a6d4a5921d0584f60b08337bc3b107bf71d2dd514447782143239a606f09d2489bb3f15ad483cefdfe1edfbf94a015ecefc8f
SSDEEP

24576:4wwcS04YNEMuExDiU6E5R9s8xY/2l/dRJ5dtsPxNGf+2xIbt+r5:4wwU4auS+UjfU2T/5XDxxIbt+r

Score

10^/10

rat success orcus

Family

orcus

Botnet

success

C2

127.0.0.1

station-installations.gl.at.ply.gg

Mutex

f73a90de8f7b4c1badbe8b401fa3780f

Attributes

administration_rights_required
false
anti_debugger
false
anti_tcp_analyzer
false
antivm
false
autostart_method
1
change_creation_date
false
force_installer_administrator_privileges
false
hide_file
false
install
false
installation_folder
%appdata%\Microsoft\Speech\AudioDriver.exe
installservice
false
keylogger_enabled
false
newcreationdate
12/25/2024 01:20:44
plugins
AgUFyfihswTdIPqEArukcmEdSF06Hw9CAFMAbwBEACAAUAByAG8AdABlAGMAdABpAG8AbgAHAzEALgAwAEEgMABjADAAYgA2ADUAOQBkADEAYQA3ADEANABlADYANAA5ADYAYQAzADIAZgBhADMAOQAwAGMAOABkADAAZgA4AAEFl6aNkQPXkQKOmwKLvFcpr24sKCsVRABpAHMAYQBiAGwAZQAgAFcAZQBiAGMAYQBtACAATABpAGcAaAB0AHMABwMxAC4AMABBIDkANAA2AGMAMQA1AGUAMwAwADAAMAA2ADQAYQBkADMAOABkADcAYgBkADUANwBiADIAMgBhAGEAOQAzAGQAZgABBcjswb8CldcC3rcCqMa3DYpVf2wVCkcAYQBtAGUAcgAgAFYAaQBlAHcABwMxAC4AMgBBIGIAYQBmADYANAA1AGEAOAAxAGEANQAyADQAMwBhAGYAYgA4AGEANQA2ADYAMgBjADcAMABjADMAZgA5ADUAOAACAAYG
proxyoption
-1
reconnect_delay
10000
registry_autostart_keyname
Audio HD Driver
registry_hidden_autostart
false
set_admin_flag
false
tasksch_name
Audio HD Driver
tasksch_request_highest_privileges
false
try_other_autostart_onfail
false

aes.plain

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
25bff9d0695d521aab5ecc9da9b36363d8e9440993146ec717f24bbaeb433fe4