Overview

overview

10

Static

static

5

b0eaf4c70a...7c.exe

windows7-x64

10

b0eaf4c70a...7c.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    b0eaf4c70a1e5bd37df19efb5497d08a1fb13c4db970e8db3304174c362de97c

  • Size

    2.7MB

  • Sample

    250312-eqpr5axly6

  • MD5

    c6c4326c46b490c2ca2177c8bed83bbd

  • SHA1

    9505b0b9728ad7c82653ba052756d5b5c4fca144

  • SHA256

    b0eaf4c70a1e5bd37df19efb5497d08a1fb13c4db970e8db3304174c362de97c

  • SHA512

    84dfa26b4fa2ef0e1ff6c184e92723fc7a47e568577203331761ce1e293cf3a8d7dad456c8c5d44accabe98fc3c5094da32d3cb600d67b1e76c45a6d2068b094

  • SSDEEP

    24576:HAHnh+eWsN3skA4RV1Hom2KXMmHaf6dKYwjtOFK3EBgLrlNuErLo5i8144OTu6aw:6h+ZkldoPK8YaSX0

Score
10/10
orcusw1nd3fdiscoveryratspywarestealer

Malware Config

Extracted

Family

orcus

Botnet

W1ND3F

C2

orcus.airdns.org:2172

Mutex

W1ND3F2238799525ef4ef7b3a20ac12f2d076b

Attributes
  • autostart_method

    Registry

  • enable_keylogger

    true

  • install_path

    %appdata%\HD Audio Driver\Version\4.201\Devices\HD Audio Driver Update.exe

  • reconnect_delay

    10000

  • registry_keyname

    HD Audio Driver Update

  • taskscheduler_taskname

    HD Audio Driver Updater

  • watchdog_path

    AppData\HD Audio Driver Sync.exe

Targets

    • Target

      b0eaf4c70a1e5bd37df19efb5497d08a1fb13c4db970e8db3304174c362de97c

    • Size

      2.7MB

    • MD5

      c6c4326c46b490c2ca2177c8bed83bbd

    • SHA1

      9505b0b9728ad7c82653ba052756d5b5c4fca144

    • SHA256

      b0eaf4c70a1e5bd37df19efb5497d08a1fb13c4db970e8db3304174c362de97c

    • SHA512

      84dfa26b4fa2ef0e1ff6c184e92723fc7a47e568577203331761ce1e293cf3a8d7dad456c8c5d44accabe98fc3c5094da32d3cb600d67b1e76c45a6d2068b094

    • SSDEEP

      24576:HAHnh+eWsN3skA4RV1Hom2KXMmHaf6dKYwjtOFK3EBgLrlNuErLo5i8144OTu6aw:6h+ZkldoPK8YaSX0

    Score
    10/10
    orcusw1nd3fdiscoveryratspywarestealer

    • Orcus

      Orcus is a Remote Access Trojan that is being sold on underground forums.

      ratspywarestealerorcus

    • Orcus family

      orcus

    • Orcurs Rat Executable

    • Drops startup file

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks