Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Behavioral task
behavioral1
Sample
49147ecaa6fb80734284257327e1f47f18914d5db04487f7c83490872a8e34e3.exe
Resource
win7-20231023-en
Behavioral task
behavioral2
Sample
49147ecaa6fb80734284257327e1f47f18914d5db04487f7c83490872a8e34e3.exe
Resource
win10v2004-20231201-en
General
-
Target
49147ecaa6fb80734284257327e1f47f18914d5db04487f7c83490872a8e34e3
-
Size
901KB
-
MD5
5d8924fefdc3af4f7877292e1ec73488
-
SHA1
74b10ac14262bd753c144d8c1a5f6858f536eb08
-
SHA256
49147ecaa6fb80734284257327e1f47f18914d5db04487f7c83490872a8e34e3
-
SHA512
bf48e13e1581030eaf7126c2227c095c85e9019baee03bcce92e208aa5b5722ae45a1096ce27226320192d48f8a77e101a4f49e31da3ccf8b410360dfd7b6394
-
SSDEEP
12288:28shHAVBuQBBed37dG1lFlWcYT70pxnnaaoawMRVcTqSA+9rZNrI0AilFEvxHvBc:v3s4MROxnF9LqrZlI0AilFEvxHioy
Malware Config
Extracted
orcus
story-towers.gl.at.ply.gg:35951
d409e1cea12b48a9935fc24bdfd1feee
-
autostart_method
Disable
-
enable_keylogger
false
-
install_path
%programfiles%\Orcus\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
Orcus
-
taskscheduler_taskname
Orcus
-
watchdog_path
AppData\OrcusWatchdog.exe
Signatures
-
Orcurs Rat Executable 1 IoCs
resource yara_rule sample orcus -
Orcus family
-
Orcus main payload 1 IoCs
resource yara_rule sample family_orcus -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 49147ecaa6fb80734284257327e1f47f18914d5db04487f7c83490872a8e34e3
Files
-
49147ecaa6fb80734284257327e1f47f18914d5db04487f7c83490872a8e34e3.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 898KB - Virtual size: 898KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ