orcus | 1f1a5f729de96c4f5d3f317ba1254ca8b2ccbc4538e0a9664326a57e613eed64

General

Target

1f1a5f729de96c4f5d3f317ba1254ca8b2ccbc4538e0a9664326a57e613eed64
Size

843KB
MD5

787b41af9d28bb93bb3b8e574f06a4cf
SHA1

9fca5a5fcbd4c1e38e9b1fa52a6af916c3267cd7
SHA256

1f1a5f729de96c4f5d3f317ba1254ca8b2ccbc4538e0a9664326a57e613eed64
SHA512

51663df1670c6da11d262e654fb3cd700b10d1fac2398ff900ff7be84673f6120dbe0290d877b9e07adb53633d5118ed29c5f585d2494a445070c4517e80c740
SSDEEP

24576:0xYS04YNEMuExDiU6E5R9s8xY/2l/dWLbB83xIbt+rl:0xA4auS+UjfU2TEb63xIbt+r

Score

10^/10

rat orcus

Family

orcus

C2

10.0.0.121

Mutex

6aebdc717ef740fcabd44e1b97100532

Attributes

administration_rights_required
false
anti_debugger
false
anti_tcp_analyzer
false
antivm
false
autostart_method
1
change_creation_date
false
force_installer_administrator_privileges
false
hide_file
false
install
false
installation_folder
%appdata%\Microsoft\Speech\AudioDriver.exe
installservice
false
keylogger_enabled
false
newcreationdate
01/19/2025 15:32:55
plugins
AgUFl6aNkQPXkQKOmwKLvFcpr24sKCsVRABpAHMAYQBiAGwAZQAgAFcAZQBiAGMAYQBtACAATABpAGcAaAB0AHMABwMxAC4AMABBIGMAOABmADEAMgBlADgAMwA0ADQAZQA5ADQAOABkAGQAOQA2AGUAMAA1AGQANABmAGYAZgAwAGMAMAA4ADQANgABAAAAAgI=
reconnect_delay
10000
registry_autostart_keyname
Audio HD Driver
registry_hidden_autostart
false
set_admin_flag
false
tasksch_name
Audio HD Driver
tasksch_request_highest_privileges
false
try_other_autostart_onfail
false

aes.plain

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
1f1a5f729de96c4f5d3f317ba1254ca8b2ccbc4538e0a9664326a57e613eed64