Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
cfa779005701baf8251281de201d9ee5790cd788f9f503f7a22bf6cf1bdb0b53
-
Size
3.0MB
-
Sample
231214-b6k74aagap
-
MD5
654f61c917469d1c3e7b1680204abfe3
-
SHA1
0fbed2074695670bb7c8d6932cfd35a1f9220afc
-
SHA256
cfa779005701baf8251281de201d9ee5790cd788f9f503f7a22bf6cf1bdb0b53
-
SHA512
e26c32eead7727694b0f0cf06484f758c7d4cd2b56d57b6fab568d59fdfb63d30fb09b44a162ba73c0fea152171ff8e2b48a4b94d413712d3e38dc2f440b352a
-
SSDEEP
49152:Y1HS7p1EZKMnkmWg8LX5prviYDyKS5AypQxbRQAo9JnCmpbu/nRFfjI7L0qb:YUHTPJg8z1mKnypSbRxo9JCm
Behavioral task
behavioral1
Sample
cfa779005701baf8251281de201d9ee5790cd788f9f503f7a22bf6cf1bdb0b53.exe
Resource
win7-20231130-en
Malware Config
Extracted
orcus
Новый тег
31.44.184.52:11426
sudo_32ai9cmpheqaajr6wmvwbsfyyynzjqz9
-
autostart_method
Disable
-
enable_keylogger
false
-
install_path
%appdata%\pollcentral\universalpython.exe
-
reconnect_delay
10000
-
registry_keyname
Sudik
-
taskscheduler_taskname
sudik
-
watchdog_path
AppData\aga.exe
Targets
-
-
Target
cfa779005701baf8251281de201d9ee5790cd788f9f503f7a22bf6cf1bdb0b53
-
Size
3.0MB
-
MD5
654f61c917469d1c3e7b1680204abfe3
-
SHA1
0fbed2074695670bb7c8d6932cfd35a1f9220afc
-
SHA256
cfa779005701baf8251281de201d9ee5790cd788f9f503f7a22bf6cf1bdb0b53
-
SHA512
e26c32eead7727694b0f0cf06484f758c7d4cd2b56d57b6fab568d59fdfb63d30fb09b44a162ba73c0fea152171ff8e2b48a4b94d413712d3e38dc2f440b352a
-
SSDEEP
49152:Y1HS7p1EZKMnkmWg8LX5prviYDyKS5AypQxbRQAo9JnCmpbu/nRFfjI7L0qb:YUHTPJg8z1mKnypSbRxo9JCm
-
Orcus main payload
-
Orcurs Rat Executable
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-