General
-
Target
a97b70b30a7c25db8563cc2bcf1ba8e4d80bf97d342cf04dc33056b17b3b1244
-
Size
1.2MB
-
Sample
241231-bg5kfawqgl
-
MD5
582b1265abcbbdba395bd9b69ff83f0a
-
SHA1
1e1dd0f95d413ffaf59f77f99439659abae97411
-
SHA256
a97b70b30a7c25db8563cc2bcf1ba8e4d80bf97d342cf04dc33056b17b3b1244
-
SHA512
fc5a3e66c0b582e234d3707986790e1683660b5d54ece1b0143d15d974e07745a68846fc0cc4282963711544f98219d3a6e633714ef4213be6fd6248d9c4affb
-
SSDEEP
24576:fpMS04YNEMuExDiU6E5R9s8xY/2l/d0J5dtsPxNGftBPIbt+rx:fpk4auS+UjfU2Tg5XD3PIbt+r
Malware Config
Extracted
orcus
127.0.0.1
f9b26218f0c9403a83fd44bec32fd191
-
administration_rights_required
false
-
anti_debugger
false
-
anti_tcp_analyzer
false
-
antivm
false
-
autostart_method
1
-
change_creation_date
false
-
force_installer_administrator_privileges
false
-
hide_file
false
-
install
false
-
installation_folder
%appdata%\Microsoft\Speech\AudioDriver.exe
-
installservice
false
-
keylogger_enabled
false
-
newcreationdate
12/30/2024 12:18:08
-
plugins
AgUFl6aNkQPXkQKOmwKLvFcpr24sKCsVRABpAHMAYQBiAGwAZQAgAFcAZQBiAGMAYQBtACAATABpAGcAaAB0AHMABwMxAC4AMABBIDIAMgA0AGQANwBlADUAOAA5ADQAZQBlADQAOQBhADkAYQBjADkAMAA5AGEAMgAxADQAMwBhADkANAAxADIAMQABBcjswb8CldcC3rcCqMa3DYpVf2wVCkcAYQBtAGUAcgAgAFYAaQBlAHcABwMxAC4AMgBBIGYAMAAxADYANgA0AGUAMAA4ADcAMQA2ADQANgAwADYAYgA5ADcANgA2AGIANwA4AGYAMQA4AGQAYQBkAGIAZQACAAAEBA==
-
reconnect_delay
10000
-
registry_autostart_keyname
Audio HD Driver
-
registry_hidden_autostart
false
-
set_admin_flag
false
-
tasksch_name
Audio HD Driver
-
tasksch_request_highest_privileges
false
-
try_other_autostart_onfail
false
Targets
-
-
Target
a97b70b30a7c25db8563cc2bcf1ba8e4d80bf97d342cf04dc33056b17b3b1244
-
Size
1.2MB
-
MD5
582b1265abcbbdba395bd9b69ff83f0a
-
SHA1
1e1dd0f95d413ffaf59f77f99439659abae97411
-
SHA256
a97b70b30a7c25db8563cc2bcf1ba8e4d80bf97d342cf04dc33056b17b3b1244
-
SHA512
fc5a3e66c0b582e234d3707986790e1683660b5d54ece1b0143d15d974e07745a68846fc0cc4282963711544f98219d3a6e633714ef4213be6fd6248d9c4affb
-
SSDEEP
24576:fpMS04YNEMuExDiU6E5R9s8xY/2l/d0J5dtsPxNGftBPIbt+rx:fpk4auS+UjfU2Tg5XD3PIbt+r
Score10/10-
Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
-
Orcus family
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-