Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    d2f03a51d3d805e1f1015334cb06ddd117efdaaccefe114b6eaf77dff877c779

  • Size

    924KB

  • Sample

    231127-c289ssdg97

  • MD5

    acd0efa2f38826fb661be48967a80f27

  • SHA1

    9654d2f77c123885b93ca0ea9b7b190360d3cd7f

  • SHA256

    d2f03a51d3d805e1f1015334cb06ddd117efdaaccefe114b6eaf77dff877c779

  • SHA512

    bee5638bf011441b7dc8e3d494a7408c71e70df3d790f670c10bb3aad6573f09cace7c81dd31c79b8f217e43e965b5f301fd20ab6e68439f0846434ab063e8f6

  • SSDEEP

    24576:gmHR4MROxnFE3kO3ZrrcI0AilFEvxHP4oog:juMiuBZrrcI0AilFEvxHP

Malware Config

Extracted

Family

orcus

Botnet

UwU

C2

172.22.45.4:4917

Mutex

7abf72e50f464a40b9e4d06e9c77b9c4

Attributes
  • autostart_method

    TaskScheduler

  • enable_keylogger

    true

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    Backup

  • taskscheduler_taskname

    Backup

  • watchdog_path

    AppData\Roblox.exe

Targets

    • Target

      d2f03a51d3d805e1f1015334cb06ddd117efdaaccefe114b6eaf77dff877c779

    • Size

      924KB

    • MD5

      acd0efa2f38826fb661be48967a80f27

    • SHA1

      9654d2f77c123885b93ca0ea9b7b190360d3cd7f

    • SHA256

      d2f03a51d3d805e1f1015334cb06ddd117efdaaccefe114b6eaf77dff877c779

    • SHA512

      bee5638bf011441b7dc8e3d494a7408c71e70df3d790f670c10bb3aad6573f09cace7c81dd31c79b8f217e43e965b5f301fd20ab6e68439f0846434ab063e8f6

    • SSDEEP

      24576:gmHR4MROxnFE3kO3ZrrcI0AilFEvxHP4oog:juMiuBZrrcI0AilFEvxHP

    • Orcus

      Orcus is a Remote Access Trojan that is being sold on underground forums.

    • Orcus main payload

    • Orcurs Rat Executable

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Loads dropped DLL

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks