Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    e682b6d71171000383f9b6bd819ae9017794b98d7a24243a4ec5b6a132876bf5

  • Size

    921KB

  • MD5

    6300a61dfb2ca101fecf2e3737c43194

  • SHA1

    361d3007da8a3dacc3d42a02b67c232ae074982f

  • SHA256

    e682b6d71171000383f9b6bd819ae9017794b98d7a24243a4ec5b6a132876bf5

  • SHA512

    991120e393165a42ceab9a31f696d6a8495545ee40218abf92a2cd631235b610156e2afd2d9d96964a5e6f6dd7ca89e516b8b474bcb9a68523ac4946aea762a4

  • SSDEEP

    24576:mkL94MROxnF43A5rrcI0AilFEvxHP3zooV:lWMiGerrcI0AilFEvxHP3

Score
10/10

Malware Config

Extracted

Family

orcus

C2

s1.putinso.site:2004

Mutex

2735597b534846cb8b384bdb5863f82c

Attributes
  • autostart_method

    TaskScheduler

  • enable_keylogger

    true

  • install_path

    %programfiles%\Regedit\svhost.exe

  • reconnect_delay

    10000

  • registry_keyname

    svhost

  • taskscheduler_taskname

    svhost

  • watchdog_path

    AppData\regedit.exe

Signatures

  • Orcurs Rat Executable 1 IoCs
  • Orcus family
  • Orcus main payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • e682b6d71171000383f9b6bd819ae9017794b98d7a24243a4ec5b6a132876bf5
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections