Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Behavioral task
behavioral1
Sample
99f845e345cabcc6db32220b4580679f442b5069d47130a4d1e53385ec30b8ae.exe
Resource
win7-20231025-en
General
-
Target
99f845e345cabcc6db32220b4580679f442b5069d47130a4d1e53385ec30b8ae
-
Size
924KB
-
MD5
270086e769ae63f6f15fe386ee301eb4
-
SHA1
5f761d634ac920615e3f8f54a496df240708e6a9
-
SHA256
99f845e345cabcc6db32220b4580679f442b5069d47130a4d1e53385ec30b8ae
-
SHA512
8b2954c851dc1e99699b016b2adaf93a9d30499b82495d8b6c2e9d02041cc677c0935f8d2149ef842ca17c23f7500febacf6e6b945d7f5931513b95d3b68dedf
-
SSDEEP
24576:JBB4MROxnFE3WO3ErrcI0AilFEvxHPvAooR:JQMiuDErrcI0AilFEvxHP
Malware Config
Extracted
orcus
192.168.1.142:10134
bbaa72868c07447d876093a337510db3
-
autostart_method
TaskScheduler
-
enable_keylogger
true
-
install_path
%programfiles%\Orcus\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
Orcus
-
watchdog_path
AppData\OrcusWatchdog.exe
Signatures
-
Orcurs Rat Executable 1 IoCs
resource yara_rule sample orcus -
Orcus family
-
Orcus main payload 1 IoCs
resource yara_rule sample family_orcus -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 99f845e345cabcc6db32220b4580679f442b5069d47130a4d1e53385ec30b8ae
Files
-
99f845e345cabcc6db32220b4580679f442b5069d47130a4d1e53385ec30b8ae.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 921KB - Virtual size: 921KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ