orcus | b02e067313bfd301eaf819b06f413a2cbc9e90b16bf70c887c7862195800c345

General

Target

b02e067313bfd301eaf819b06f413a2cbc9e90b16bf70c887c7862195800c345
Size

2.2MB
MD5

31ad36a69481db1bf5a276a89b984467
SHA1

3c28622264f13eb14e9b61b7ec7d35ed85a851bf
SHA256

b02e067313bfd301eaf819b06f413a2cbc9e90b16bf70c887c7862195800c345
SHA512

f0e6e4fbb60f657b9d051494ececedfbedcfee9c0b3fde12b4b074c0ddbcebdda8d801336ea29332eddd903b59390715519a8b6f6e003fdeedf1ea85f5832d4d
SSDEEP

24576:DC6IS04YNEMuExDiU6E5R9s8xY/2l/dRJ5dtsPxNGfH29Ibt+rr:DC6Q4auS+UjfU2T/5XD+9Ibt+r

Score

10^/10

rat vero orcus

Family

orcus

Botnet

Vero

C2

127.0.0.1

Mutex

ee94f4ef3440498a9fb62ab5e70e6d04

Attributes

administration_rights_required
false
anti_debugger
false
anti_tcp_analyzer
false
antivm
false
autostart_method
1
change_creation_date
false
force_installer_administrator_privileges
false
hide_file
false
install
false
installation_folder
%appdata%\Microsoft\Speech\AudioDriver.exe
installservice
false
keylogger_enabled
false
newcreationdate
01/22/2025 00:49:03
plugins
AgUFyfihswTdIPqEArukcmEdSF06Hw9CAFMAbwBEACAAUAByAG8AdABlAGMAdABpAG8AbgAHAzEALgAwAEEgMgBlADAAOQBmADIAYQBhADMAMQBkAGYANABiAGMANAA5ADAANwA1ADAAZgA3ADAAMABkADMAYgAzADMAOAA3AAEFl6aNkQPXkQKOmwKLvFcpr24sKCsVRABpAHMAYQBiAGwAZQAgAFcAZQBiAGMAYQBtACAATABpAGcAaAB0AHMABwMxAC4AMABBIGEAMAAzAGUAYgA2ADIANwBhADYAMABhADQAYwBjADQAYgAwADEAMgA4ADIAMQBiADAAOQBhAGMANQAxADcAOQABBcjswb8CldcC3rcCqMa3DYpVf2wVCkcAYQBtAGUAcgAgAFYAaQBlAHcABwMxAC4AMgBBIGMAMAAxADQAOQA4ADEAZQA3ADMANgA5ADQAMgAxADIAOQAzAGMAYQBjAGMANgBmADQAYwAwAGUAYgA0ADYAMwACAAYG
reconnect_delay
10000
registry_autostart_keyname
Audio HD Driver
registry_hidden_autostart
false
set_admin_flag
false
tasksch_name
Audio HD Driver
tasksch_request_highest_privileges
false
try_other_autostart_onfail
false

aes.plain

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
b02e067313bfd301eaf819b06f413a2cbc9e90b16bf70c887c7862195800c345