orcus | 138b682d76b3ec1a4a84406c3f6a0ee2da29bec0ae6feb6c05f7b6c8eb98b96f

General

Target

138b682d76b3ec1a4a84406c3f6a0ee2da29bec0ae6feb6c05f7b6c8eb98b96f
Size

845KB
MD5

87763ae22a66ea3276fe9b14d65725ea
SHA1

908228d0bba0351a4c4bf25ab4ae2b41ed520f7d
SHA256

138b682d76b3ec1a4a84406c3f6a0ee2da29bec0ae6feb6c05f7b6c8eb98b96f
SHA512

fdf7ba8ebc84b8cb9e3fdaf34d5c035d3456cdc671a6cf0ea1774dc73f4931d95fcdbf25605991028f5236097af6484e2aa9679baf580c15ea982e14f31f30e4
SSDEEP

24576:FvS04YNEMuExDiU6E5R9s8xY/2l/dHzIbt+ra:FF4auS+UjfU2THzIbt+r

Score

10^/10

rat orcus

Family

orcus

C2

5.tcp.eu.ngrok.io

Mutex

c1334eeff3214c87b1304d7c8b23eddd

Attributes

administration_rights_required
false
anti_debugger
false
anti_tcp_analyzer
false
antivm
false
autostart_method
1
change_creation_date
false
force_installer_administrator_privileges
false
hide_file
false
install
false
installation_folder
%appdata%\Microsoft\Speech\AudioDriver.exe
installservice
false
keylogger_enabled
false
newcreationdate
01/13/2025 10:04:41
plugins
AgUFyfihswTdIPqEArukcmEdSF06Hw9CAFMAbwBEACAAUAByAG8AdABlAGMAdABpAG8AbgAHAzEALgAwAEEgYwAyADUAOAA0ADYAOAA1AGQAZQBlAGEANABkAGMANAA4ADcANQBmAGYAZABjADgAMQA2AGEAOAAxADMAMAAzAAEFl6aNkQPXkQKOmwKLvFcpr24sKCsVRABpAHMAYQBiAGwAZQAgAFcAZQBiAGMAYQBtACAATABpAGcAaAB0AHMABwMxAC4AMABBIGYAMQA5ADEAMwA3ADAAZgBhAGEAMwA4ADQANwBmADIAYgA2AGEAYwBiADIAMwA1ADgAZAA3AGQAOAA1ADQAOQABAAAEBA==
reconnect_delay
10000
registry_autostart_keyname
Audio HD Driver
registry_hidden_autostart
false
set_admin_flag
false
tasksch_name
Audio HD Driver
tasksch_request_highest_privileges
false
try_other_autostart_onfail
false

aes.plain

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
138b682d76b3ec1a4a84406c3f6a0ee2da29bec0ae6feb6c05f7b6c8eb98b96f