General
-
Target
a2172a9118b8474807e70336b7db893b10669e59daaf4dfb51d3ecd1bccbca50
-
Size
846KB
-
Sample
250216-bfnwastndj
-
MD5
c1252c7ca211eb57854c566c98945afa
-
SHA1
d4d192dc0c540c994f9226ecedab63ec00249eda
-
SHA256
a2172a9118b8474807e70336b7db893b10669e59daaf4dfb51d3ecd1bccbca50
-
SHA512
26c5acab67fb3d9db8633bb8ad634889436771c4dca9b3a3d0d373cbece559134a4d7bd04ce376bd34fd186b70dcce917bd3302aed0dda356fd6a4f03b8d1e6e
-
SSDEEP
24576:VieYS04YNEMuExDiU6E5R9s8xY/2l/dFoIbt+ra:VjA4auS+UjfU2TuIbt+r
Behavioral task
behavioral1
Sample
a2172a9118b8474807e70336b7db893b10669e59daaf4dfb51d3ecd1bccbca50.exe
Resource
win7-20241010-en
Malware Config
Extracted
orcus
147.185.221.26
Z;within-contacted.gl.at.ply.gg
2d0098cbc4bd4aba8c98855f073ddae5
-
administration_rights_required
false
-
anti_debugger
false
-
anti_tcp_analyzer
false
-
antivm
false
-
autostart_method
1
-
change_creation_date
false
-
force_installer_administrator_privileges
false
-
hide_file
false
-
install
false
-
installation_folder
%appdata%\Microsoft\Speech\AudioDriver.exe
-
installservice
false
-
keylogger_enabled
false
-
newcreationdate
02/15/2025 16:16:16
-
plugins
AgUFyfihswTdIPqEArukcmEdSF06Hw9CAFMAbwBEACAAUAByAG8AdABlAGMAdABpAG8AbgAHAzEALgAwAEEgYgA1AGEANAA3AGUANQBhADYAOABmAGEANABiADMAMgBiADMAYgA4AGYAMwBhADIAMQBlAGQANwBkADEAZQA1AAEFl6aNkQPXkQKOmwKLvFcpr24sKCsVRABpAHMAYQBiAGwAZQAgAFcAZQBiAGMAYQBtACAATABpAGcAaAB0AHMABwMxAC4AMABBIGIANQAwAGIANgAzAGUAZAAwADEAOQA2ADQANgA2AGEAYgBiADAANQA5AGEAOQA1AGUAZgA2AGQAZAA4ADEAYQABAAAEBA==
-
reconnect_delay
10000
-
registry_autostart_keyname
Audio HD Driver
-
registry_hidden_autostart
false
-
set_admin_flag
false
-
tasksch_name
Audio HD Driver
-
tasksch_request_highest_privileges
false
-
try_other_autostart_onfail
false
Targets
-
-
Target
a2172a9118b8474807e70336b7db893b10669e59daaf4dfb51d3ecd1bccbca50
-
Size
846KB
-
MD5
c1252c7ca211eb57854c566c98945afa
-
SHA1
d4d192dc0c540c994f9226ecedab63ec00249eda
-
SHA256
a2172a9118b8474807e70336b7db893b10669e59daaf4dfb51d3ecd1bccbca50
-
SHA512
26c5acab67fb3d9db8633bb8ad634889436771c4dca9b3a3d0d373cbece559134a4d7bd04ce376bd34fd186b70dcce917bd3302aed0dda356fd6a4f03b8d1e6e
-
SSDEEP
24576:VieYS04YNEMuExDiU6E5R9s8xY/2l/dFoIbt+ra:VjA4auS+UjfU2TuIbt+r
-
Orcus family
-
Downloads MZ/PE file
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-