Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
509cfaac45f23bf4bba6fd9f0a631d483d44c04930eeb5a3e68f3badcbd9bba0
-
Size
5.0MB
-
Sample
240106-bggtdafae2
-
MD5
149bf9d2125e78f56f5b8af10d1016ed
-
SHA1
f64771515acabec2e1b092a929a4fdbd6b4b4307
-
SHA256
509cfaac45f23bf4bba6fd9f0a631d483d44c04930eeb5a3e68f3badcbd9bba0
-
SHA512
3996192663ce95a872f636585bfd815fbea22fc9f7fbd46fa4a0b2747d5625e98d34c8565ad7cfee158be9d3c2d2a5472ba6a728c1b36ab0867539ef279e2e13
-
SSDEEP
24576:uWM4MROxnFE3jdc1RrrZlI0AilFEvxHioRn:uWfMiuObrrZlI0AilFEvxHio
Behavioral task
behavioral1
Sample
509cfaac45f23bf4bba6fd9f0a631d483d44c04930eeb5a3e68f3badcbd9bba0.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
509cfaac45f23bf4bba6fd9f0a631d483d44c04930eeb5a3e68f3badcbd9bba0.exe
Resource
win10v2004-20231222-en
Malware Config
Extracted
orcus
10.0.2.15:4444
afe4268b3e1340c8b922890ff0856cb0
-
autostart_method
Registry
-
enable_keylogger
true
-
install_path
%programfiles%\Orcus\Orcus.exe
-
reconnect_delay
10000
-
registry_keyname
explorer
-
taskscheduler_taskname
java
-
watchdog_path
AppData\java.exe
Targets
-
-
Target
509cfaac45f23bf4bba6fd9f0a631d483d44c04930eeb5a3e68f3badcbd9bba0
-
Size
5.0MB
-
MD5
149bf9d2125e78f56f5b8af10d1016ed
-
SHA1
f64771515acabec2e1b092a929a4fdbd6b4b4307
-
SHA256
509cfaac45f23bf4bba6fd9f0a631d483d44c04930eeb5a3e68f3badcbd9bba0
-
SHA512
3996192663ce95a872f636585bfd815fbea22fc9f7fbd46fa4a0b2747d5625e98d34c8565ad7cfee158be9d3c2d2a5472ba6a728c1b36ab0867539ef279e2e13
-
SSDEEP
24576:uWM4MROxnFE3jdc1RrrZlI0AilFEvxHioRn:uWfMiuObrrZlI0AilFEvxHio
Score10/10-
Orcurs Rat Executable
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory
-