Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
a98ce4d47470483d86072c823711f60af11b3cb44dc828335bd0d6eabf5f5a2b
-
Size
3.2MB
-
Sample
231127-b8tl9ade91
-
MD5
d4aa8ca140e8278dc0362868616e4f36
-
SHA1
4d760696dcdc41ac5e4937f86ef5fa5804d9deea
-
SHA256
a98ce4d47470483d86072c823711f60af11b3cb44dc828335bd0d6eabf5f5a2b
-
SHA512
8290de36ba1641610e26b76bc5e5af1abcc2783f0b3b4f880e6979e7c3ad0dd98fc2e8d708cff36a9d594b6af9e8782efb567f3e894d476dd310eb31992640a2
-
SSDEEP
98304:rIFypVxbUsQhlhjQ4YlSXtypSb57to9JCm:sFLsQh7jbypSd7oJC
Behavioral task
behavioral1
Sample
a98ce4d47470483d86072c823711f60af11b3cb44dc828335bd0d6eabf5f5a2b.exe
Resource
win7-20231025-en
Malware Config
Extracted
orcus
dfwfdsfsdasd.project-nightfall.com:3007
aa286d2e836040dd92c47ff0b43d6918
-
autostart_method
Registry
-
enable_keylogger
false
-
install_path
%appdata%\WatchDogs2\Scripthook.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
Orcus
-
watchdog_path
AppData\OrcusWatchdog.exe
Targets
-
-
Target
a98ce4d47470483d86072c823711f60af11b3cb44dc828335bd0d6eabf5f5a2b
-
Size
3.2MB
-
MD5
d4aa8ca140e8278dc0362868616e4f36
-
SHA1
4d760696dcdc41ac5e4937f86ef5fa5804d9deea
-
SHA256
a98ce4d47470483d86072c823711f60af11b3cb44dc828335bd0d6eabf5f5a2b
-
SHA512
8290de36ba1641610e26b76bc5e5af1abcc2783f0b3b4f880e6979e7c3ad0dd98fc2e8d708cff36a9d594b6af9e8782efb567f3e894d476dd310eb31992640a2
-
SSDEEP
98304:rIFypVxbUsQhlhjQ4YlSXtypSb57to9JCm:sFLsQh7jbypSd7oJC
-
Orcurs Rat Executable
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-