Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

General

  • Target

    509cfaac45f23bf4bba6fd9f0a631d483d44c04930eeb5a3e68f3badcbd9bba0

  • Size

    5.0MB

  • Sample

    240106-bggtdafae2

  • MD5

    149bf9d2125e78f56f5b8af10d1016ed

  • SHA1

    f64771515acabec2e1b092a929a4fdbd6b4b4307

  • SHA256

    509cfaac45f23bf4bba6fd9f0a631d483d44c04930eeb5a3e68f3badcbd9bba0

  • SHA512

    3996192663ce95a872f636585bfd815fbea22fc9f7fbd46fa4a0b2747d5625e98d34c8565ad7cfee158be9d3c2d2a5472ba6a728c1b36ab0867539ef279e2e13

  • SSDEEP

    24576:uWM4MROxnFE3jdc1RrrZlI0AilFEvxHioRn:uWfMiuObrrZlI0AilFEvxHio

Malware Config

Extracted

Family

orcus

C2

10.0.2.15:4444

Mutex

afe4268b3e1340c8b922890ff0856cb0

Attributes
  • autostart_method

    Registry

  • enable_keylogger

    true

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    explorer

  • taskscheduler_taskname

    java

  • watchdog_path

    AppData\java.exe

Targets

    • Target

      509cfaac45f23bf4bba6fd9f0a631d483d44c04930eeb5a3e68f3badcbd9bba0

    • Size

      5.0MB

    • MD5

      149bf9d2125e78f56f5b8af10d1016ed

    • SHA1

      f64771515acabec2e1b092a929a4fdbd6b4b4307

    • SHA256

      509cfaac45f23bf4bba6fd9f0a631d483d44c04930eeb5a3e68f3badcbd9bba0

    • SHA512

      3996192663ce95a872f636585bfd815fbea22fc9f7fbd46fa4a0b2747d5625e98d34c8565ad7cfee158be9d3c2d2a5472ba6a728c1b36ab0867539ef279e2e13

    • SSDEEP

      24576:uWM4MROxnFE3jdc1RrrZlI0AilFEvxHioRn:uWfMiuObrrZlI0AilFEvxHio

    • Orcus

      Orcus is a Remote Access Trojan that is being sold on underground forums.

    • Orcurs Rat Executable

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

    • Drops file in System32 directory

MITRE ATT&CK Enterprise v15

Tasks