General
-
Target
1f2082894179434f7f9180d3cf553d056755df6af57f6117bd3237486c6478db
-
Size
1.2MB
-
Sample
250210-bmk3zsxngl
-
MD5
2a03b08eba89b4d692752ee2501a3cd1
-
SHA1
0cf46736c4c12373645950f3942d73e853e3787b
-
SHA256
1f2082894179434f7f9180d3cf553d056755df6af57f6117bd3237486c6478db
-
SHA512
c94eff8f0d84fd7216771c90e1666cd69ad469d9749547dbe49dd641f3c52e4ebf42856d225743f2f95b589fb98437975cc553754f6b8f37460b16b18c7bffc0
-
SSDEEP
24576:rsS04YNEMuExDiU6E5R9s8xY/2l/d0J5dtsPxNGf52Ibt+ra:rE4auS+UjfU2Tg5XDB2Ibt+r
Malware Config
Extracted
orcus
1super-lanes.gl.at.ply.gg
b11a7be0846e4a719622a62b6ab81191
-
administration_rights_required
false
-
anti_debugger
false
-
anti_tcp_analyzer
false
-
antivm
false
-
autostart_method
1
-
change_creation_date
false
-
force_installer_administrator_privileges
false
-
hide_file
false
-
install
false
-
installation_folder
%appdata%\Microsoft\Speech\AudioDriver.exe
-
installservice
false
-
keylogger_enabled
false
-
newcreationdate
02/09/2025 14:39:26
-
plugins
AgUFl6aNkQPXkQKOmwKLvFcpr24sKCsVRABpAHMAYQBiAGwAZQAgAFcAZQBiAGMAYQBtACAATABpAGcAaAB0AHMABwMxAC4AMABBIDgAOAA1AGYAMQA5AGUAMQAzADgAOQBmADQAZAAyAGQAOQAxADkANABjADYAMQBkAGIAMwA4AGIANQAxADMAMQABBcjswb8CldcC3rcCqMa3DYpVf2wVCkcAYQBtAGUAcgAgAFYAaQBlAHcABwMxAC4AMgBBIDcAMQAxADMAMQAyADIAYwBlADUANwBkADQAMQBjADkAYQA1ADIAZgBjADgAZAA4AGUAZgBmAGEAYQA4ADUAZQACAAAEBA==
-
reconnect_delay
10000
-
registry_autostart_keyname
Audio HD Driver
-
registry_hidden_autostart
false
-
set_admin_flag
false
-
tasksch_name
Audio HD Driver
-
tasksch_request_highest_privileges
false
-
try_other_autostart_onfail
false
Targets
-
-
Target
1f2082894179434f7f9180d3cf553d056755df6af57f6117bd3237486c6478db
-
Size
1.2MB
-
MD5
2a03b08eba89b4d692752ee2501a3cd1
-
SHA1
0cf46736c4c12373645950f3942d73e853e3787b
-
SHA256
1f2082894179434f7f9180d3cf553d056755df6af57f6117bd3237486c6478db
-
SHA512
c94eff8f0d84fd7216771c90e1666cd69ad469d9749547dbe49dd641f3c52e4ebf42856d225743f2f95b589fb98437975cc553754f6b8f37460b16b18c7bffc0
-
SSDEEP
24576:rsS04YNEMuExDiU6E5R9s8xY/2l/d0J5dtsPxNGf52Ibt+ra:rE4auS+UjfU2Tg5XDB2Ibt+r
Score10/10-
Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
-
Orcus family
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Drops desktop.ini file(s)
-