Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    826920b068fcd8e8f2e4e8c89ba57d48aafdd5c590d8095dee42c41e3b00bb35

  • Size

    924KB

  • Sample

    231129-bhmq1sdf6w

  • MD5

    f8fe69119f6e7c63c57660e3fc31eca8

  • SHA1

    69bf05411c9093f4829260dea5bdaad0af14be24

  • SHA256

    826920b068fcd8e8f2e4e8c89ba57d48aafdd5c590d8095dee42c41e3b00bb35

  • SHA512

    9415dbdf30fa22630f02c263d9c24d636dcb0a51445211998acd41a68106ebfd0117dfe6cd80351d345734291eca798c2323fb26db4487167f14511b1072012b

  • SSDEEP

    24576:oCC4MROxnFE3mibrrcI0AilFEvxHPnAooM:oKMiupbrrcI0AilFEvxHP

Malware Config

Extracted

Family

orcus

Botnet

Vladimir Konovalov

C2

192.168.43.78:6969

Mutex

f4d83399629340b38d6c7bdecf066480

Attributes
  • autostart_method

    TaskScheduler

  • enable_keylogger

    true

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\OrcusWatchdog.exe

Targets

    • Target

      826920b068fcd8e8f2e4e8c89ba57d48aafdd5c590d8095dee42c41e3b00bb35

    • Size

      924KB

    • MD5

      f8fe69119f6e7c63c57660e3fc31eca8

    • SHA1

      69bf05411c9093f4829260dea5bdaad0af14be24

    • SHA256

      826920b068fcd8e8f2e4e8c89ba57d48aafdd5c590d8095dee42c41e3b00bb35

    • SHA512

      9415dbdf30fa22630f02c263d9c24d636dcb0a51445211998acd41a68106ebfd0117dfe6cd80351d345734291eca798c2323fb26db4487167f14511b1072012b

    • SSDEEP

      24576:oCC4MROxnFE3mibrrcI0AilFEvxHPnAooM:oKMiupbrrcI0AilFEvxHP

    • Orcus

      Orcus is a Remote Access Trojan that is being sold on underground forums.

    • Orcurs Rat Executable

MITRE ATT&CK Matrix

Tasks