General
-
Target
408208c7baccb589dd4cb6339cda1f089eefcc6aa94c3ffe5d27ff0c50408953
-
Size
845KB
-
Sample
250114-bl2z4ssnbw
-
MD5
fe7464234b05dd43a899ecba564bc33e
-
SHA1
8ff7985f1cc14fbadffa98a8996f1a23210941e6
-
SHA256
408208c7baccb589dd4cb6339cda1f089eefcc6aa94c3ffe5d27ff0c50408953
-
SHA512
1da2270f3a4c28cdb6c52e23244ef0b72bfab387a327fbc0422f608183b260315980ee364dee98ab0027c7c3bba94c3f06361abb0eddbbf162aaad0bcb52b74b
-
SSDEEP
24576:YvS04YNEMuExDiU6E5R9s8xY/2l/dH6zIbt+rE:YF4auS+UjfU2THyIbt+r
Malware Config
Extracted
orcus
0.tcp.eu.ngrok.io
40a65cb5542d4b6391fecc9c49f47c96
-
administration_rights_required
false
-
anti_debugger
false
-
anti_tcp_analyzer
false
-
antivm
false
-
autostart_method
1
-
change_creation_date
false
-
force_installer_administrator_privileges
false
-
hide_file
false
-
install
false
-
installation_folder
%appdata%\Microsoft\Speech\AudioDriver.exe
-
installservice
false
-
keylogger_enabled
false
-
newcreationdate
01/13/2025 14:03:15
-
plugins
AgUFyfihswTdIPqEArukcmEdSF06Hw9CAFMAbwBEACAAUAByAG8AdABlAGMAdABpAG8AbgAHAzEALgAwAEEgMwBhADUAMAAyADUAMQA2ADkAYgA4ADMANAA1ADEANAA5AGUANAAwAGEAZQA2ADMAOQBlAGYAMgA5ADMAOAA4AAEFl6aNkQPXkQKOmwKLvFcpr24sKCsVRABpAHMAYQBiAGwAZQAgAFcAZQBiAGMAYQBtACAATABpAGcAaAB0AHMABwMxAC4AMABBIDQAOAAyADAANwA5AGMAYgA1ADgAZQA3ADQANAA2AGMAOAAxADEANgA2AGQAOAAxADcAZQA4AGYAMgA4AGMAYwABAAAEBA==
-
reconnect_delay
10000
-
registry_autostart_keyname
Audio HD Driver
-
registry_hidden_autostart
false
-
set_admin_flag
false
-
tasksch_name
Audio HD Driver
-
tasksch_request_highest_privileges
false
-
try_other_autostart_onfail
false
Targets
-
-
Target
408208c7baccb589dd4cb6339cda1f089eefcc6aa94c3ffe5d27ff0c50408953
-
Size
845KB
-
MD5
fe7464234b05dd43a899ecba564bc33e
-
SHA1
8ff7985f1cc14fbadffa98a8996f1a23210941e6
-
SHA256
408208c7baccb589dd4cb6339cda1f089eefcc6aa94c3ffe5d27ff0c50408953
-
SHA512
1da2270f3a4c28cdb6c52e23244ef0b72bfab387a327fbc0422f608183b260315980ee364dee98ab0027c7c3bba94c3f06361abb0eddbbf162aaad0bcb52b74b
-
SSDEEP
24576:YvS04YNEMuExDiU6E5R9s8xY/2l/dH6zIbt+rE:YF4auS+UjfU2THyIbt+r
Score10/10-
Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
-
Orcus family
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Drops desktop.ini file(s)
-
Legitimate hosting services abused for malware hosting/C2
-