orcus | 92ffaa21da793fcc3954002c2e0070a61b72e30a63091948020433e0e713dfeb

General

Target

92ffaa21da793fcc3954002c2e0070a61b72e30a63091948020433e0e713dfeb
Size

938KB
MD5

7e20fb5ccb4ee4d082463bf93676609f
SHA1

3d19d8c3c110c51f00d8acfa409a03f2b1d4ada3
SHA256

92ffaa21da793fcc3954002c2e0070a61b72e30a63091948020433e0e713dfeb
SHA512

070aa0312e44063ca03bb38e19153840cc38ab76f291a3db701c52d58a69e1c43223cfce3cedfc1933c0ba472513473d63ac926abc13aa589cff19377a7f33a1
SSDEEP

24576:SxYS04YNEMuExDiU6E5R9s8xY/2l/dqLc83SIbt+r6vzfc:SxA4auS+UjfU2TAt3SIbt+rMf

Score

10^/10

rat orcus

Family

orcus

C2

127.0.0.1

Mutex

8a7dd5f5b1d2409b918e3dcfb5b43d28

Attributes

administration_rights_required
false
anti_debugger
false
anti_tcp_analyzer
false
antivm
false
autostart_method
1
change_creation_date
false
force_installer_administrator_privileges
false
hide_file
false
install
false
installation_folder
%appdata%\Microsoft\Speech\AudioDriver.exe
installservice
false
keylogger_enabled
false
newcreationdate
01/13/2025 09:33:33
plugins
AgUFl6aNkQPXkQKOmwKLvFcpr24sKCsVRABpAHMAYQBiAGwAZQAgAFcAZQBiAGMAYQBtACAATABpAGcAaAB0AHMABwMxAC4AMABBIDMAYwA3ADMANAAyADcAYQBjAGMANQBlADQAYwBjADkAOQA0ADAAMwA1ADYAZABjADAAZAAxADEAYQA5ADMAZAABAAAAAgI=
reconnect_delay
10000
registry_autostart_keyname
Audio HD Driver
registry_hidden_autostart
false
set_admin_flag
false
tasksch_name
Audio HD Driver
tasksch_request_highest_privileges
false
try_other_autostart_onfail
false

aes.plain

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
92ffaa21da793fcc3954002c2e0070a61b72e30a63091948020433e0e713dfeb