General
-
Target
09ba42a0b11fed3058e954f0407c43250d4377e2c23485390a982568221fff46
-
Size
846KB
-
Sample
250215-bpswlsslaq
-
MD5
29bcbada13eb4cd1a57809512ec2551b
-
SHA1
229a8cf3738e21bea17b53fee3db33053aca4e00
-
SHA256
09ba42a0b11fed3058e954f0407c43250d4377e2c23485390a982568221fff46
-
SHA512
fd1b5f484bbcbcc4c8b1e1efe16a9ca830b4ccb05d10903ec4fbb5dc03db714be64d9794b525b9f55f75582fb203138c5a1648281d7a9ac6e6ec3714a92d2282
-
SSDEEP
24576:YItS04YNEMuExDiU6E5R9s8xY/2l/ddfIbt+rS:YI/4auS+UjfU2ThIbt+r
Malware Config
Extracted
orcus
done-onto.gl.at.ply.gg
147.185.221.25
9934d4dcb6ff43668d7947106523aea8
-
administration_rights_required
false
-
anti_debugger
false
-
anti_tcp_analyzer
false
-
antivm
false
-
autostart_method
1
-
change_creation_date
false
-
force_installer_administrator_privileges
false
-
hide_file
false
-
install
false
-
installation_folder
%appdata%\Microsoft\Speech\AudioDriver.exe
-
installservice
false
-
keylogger_enabled
false
-
newcreationdate
02/13/2025 18:01:28
-
plugins
AgUFyfihswTdIPqEArukcmEdSF06Hw9CAFMAbwBEACAAUAByAG8AdABlAGMAdABpAG8AbgAHAzEALgAwAEEgYQA5AGIAZgA1ADAAMQA5ADIANgBlADgANAA5AGEAZgA4ADYAMABiAGMAYgA2AGQAYwBhAGEAOQA2AGEANgA4AAEFl6aNkQPXkQKOmwKLvFcpr24sKCsVRABpAHMAYQBiAGwAZQAgAFcAZQBiAGMAYQBtACAATABpAGcAaAB0AHMABwMxAC4AMABBIDAAYwA1ADkAYgAwADYAMwA3ADgAYwAxADQAMwA5ADIAOQA5ADcAOAAzADEAOABkADkAOABkADAAOAAxAGQAYgABAAAEBA==
-
reconnect_delay
10000
-
registry_autostart_keyname
Audio HD Driver
-
registry_hidden_autostart
false
-
set_admin_flag
false
-
tasksch_name
Audio HD Driver
-
tasksch_request_highest_privileges
false
-
try_other_autostart_onfail
false
Targets
-
-
Target
09ba42a0b11fed3058e954f0407c43250d4377e2c23485390a982568221fff46
-
Size
846KB
-
MD5
29bcbada13eb4cd1a57809512ec2551b
-
SHA1
229a8cf3738e21bea17b53fee3db33053aca4e00
-
SHA256
09ba42a0b11fed3058e954f0407c43250d4377e2c23485390a982568221fff46
-
SHA512
fd1b5f484bbcbcc4c8b1e1efe16a9ca830b4ccb05d10903ec4fbb5dc03db714be64d9794b525b9f55f75582fb203138c5a1648281d7a9ac6e6ec3714a92d2282
-
SSDEEP
24576:YItS04YNEMuExDiU6E5R9s8xY/2l/ddfIbt+rS:YI/4auS+UjfU2ThIbt+r
Score10/10-
Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
-
Orcus family
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-