Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    b06c250972d8cbae11e5e3fdc985b51c9d20f102f47f85a4548729a131eaae1f

  • Size

    924KB

  • Sample

    231129-bepffadf5w

  • MD5

    9d75466d9b777729c1d1cbfb6fb4327a

  • SHA1

    0da5ef50635ca28680347c8bffc0f3ea67905959

  • SHA256

    b06c250972d8cbae11e5e3fdc985b51c9d20f102f47f85a4548729a131eaae1f

  • SHA512

    b938835a8f1e5c63e222fa5ec6abc5a2fc9e42ed8fdec356e556021d7ae98b699bbc5d9f64f3540619f3892c695d24fbcbf615dd1f2a417c38ecc50b65c36eca

  • SSDEEP

    24576:oCC4MROxnFE3mierrcI0AilFEvxHPxAooM:oKMiuperrcI0AilFEvxHP

Malware Config

Extracted

Family

orcus

Botnet

Vladimir Konovalov

C2

192.168.43.78:6969

Mutex

f4d83399629340b38d6c7bdecf066480

Attributes
  • autostart_method

    TaskScheduler

  • enable_keylogger

    true

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\OrcusWatchdog.exe

Targets

    • Target

      b06c250972d8cbae11e5e3fdc985b51c9d20f102f47f85a4548729a131eaae1f

    • Size

      924KB

    • MD5

      9d75466d9b777729c1d1cbfb6fb4327a

    • SHA1

      0da5ef50635ca28680347c8bffc0f3ea67905959

    • SHA256

      b06c250972d8cbae11e5e3fdc985b51c9d20f102f47f85a4548729a131eaae1f

    • SHA512

      b938835a8f1e5c63e222fa5ec6abc5a2fc9e42ed8fdec356e556021d7ae98b699bbc5d9f64f3540619f3892c695d24fbcbf615dd1f2a417c38ecc50b65c36eca

    • SSDEEP

      24576:oCC4MROxnFE3mierrcI0AilFEvxHPxAooM:oKMiuperrcI0AilFEvxHP

    • Orcus

      Orcus is a Remote Access Trojan that is being sold on underground forums.

    • Orcurs Rat Executable

MITRE ATT&CK Matrix

Tasks