General
-
Target
idk.exe
-
Size
839KB
-
Sample
250113-dzd7batldw
-
MD5
cc5e9089906ca9cd8c76688d62be4e1c
-
SHA1
9fde92321e5939592d8eea3997b83167f232473e
-
SHA256
44ad3ca81f002ab0dd559453f60ce86c7608649962c42ca2ece930ed2ff1116e
-
SHA512
1e0c556a3ef3f272c0a91d0463ebf93819711fc1e3fb309b4b1f3a1f7b2358a46c6b6ec6b708074e6ae3178b5272bfb6c0581a2b58f11105d44b1ad04dfee3b3
-
SSDEEP
24576:+xdS04YNEMuExDiU6E5R9s8xY/2l/d2tnIbt+rM:qP4auS+UjfU2T2dIbt+r
Malware Config
Extracted
orcus
9across-entitled.gl.at.ply.gg
1d3ad2e8915c495cbc7efe28a9032f13
-
administration_rights_required
false
-
anti_debugger
false
-
anti_tcp_analyzer
false
-
antivm
false
-
autostart_method
1
-
change_creation_date
false
-
force_installer_administrator_privileges
false
-
hide_file
false
-
install
false
-
installation_folder
%appdata%\Microsoft\Speech\AudioDriver.exe
-
installservice
false
-
keylogger_enabled
false
-
newcreationdate
01/12/2025 14:14:22
-
plugins
AgEAAA==
-
reconnect_delay
10000
-
registry_autostart_keyname
Audio HD Driver
-
registry_hidden_autostart
false
-
set_admin_flag
false
-
tasksch_name
Audio HD Driver
-
tasksch_request_highest_privileges
false
-
try_other_autostart_onfail
false
Targets
-
-
Target
idk.exe
-
Size
839KB
-
MD5
cc5e9089906ca9cd8c76688d62be4e1c
-
SHA1
9fde92321e5939592d8eea3997b83167f232473e
-
SHA256
44ad3ca81f002ab0dd559453f60ce86c7608649962c42ca2ece930ed2ff1116e
-
SHA512
1e0c556a3ef3f272c0a91d0463ebf93819711fc1e3fb309b4b1f3a1f7b2358a46c6b6ec6b708074e6ae3178b5272bfb6c0581a2b58f11105d44b1ad04dfee3b3
-
SSDEEP
24576:+xdS04YNEMuExDiU6E5R9s8xY/2l/d2tnIbt+rM:qP4auS+UjfU2T2dIbt+r
Score10/10-
Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
-
Orcus family
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Drops desktop.ini file(s)
-