Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
b61abc841fb6d962818b3d63cf01a198d2e4b2bc050d51080f991b53c3ebe2c0
-
Size
924KB
-
Sample
240107-bdq8msbdeq
-
MD5
5e6348711ce80a4a56b6e3284e06df44
-
SHA1
b1bf6a8d21d0922b1fcee7bafe82677dbcbf6f9b
-
SHA256
b61abc841fb6d962818b3d63cf01a198d2e4b2bc050d51080f991b53c3ebe2c0
-
SHA512
05d04f0fa8323bbf58c1fa9b9a66d672573a57cddaa6f57cb00d136f3ee797ce8cc32d5365528b9b4ab44354e89f713d6e921641983f823757174ab5f70d63e8
-
SSDEEP
24576:0Vr4MROxnFE3+O3+rrcI0AilFEvxHPWooZ:0WMiuL+rrcI0AilFEvxHP
Behavioral task
behavioral1
Sample
b61abc841fb6d962818b3d63cf01a198d2e4b2bc050d51080f991b53c3ebe2c0.exe
Resource
win7-20231215-en
Malware Config
Extracted
orcus
10.241.74.120:10130
90f0ab4d333f440d9f794c6544def39c
-
autostart_method
Registry
-
enable_keylogger
false
-
install_path
%programfiles%\shelter\shelter.exe
-
reconnect_delay
10000
-
registry_keyname
shelter
-
taskscheduler_taskname
Orcus
-
watchdog_path
Temp\shelter.exe
Targets
-
-
Target
b61abc841fb6d962818b3d63cf01a198d2e4b2bc050d51080f991b53c3ebe2c0
-
Size
924KB
-
MD5
5e6348711ce80a4a56b6e3284e06df44
-
SHA1
b1bf6a8d21d0922b1fcee7bafe82677dbcbf6f9b
-
SHA256
b61abc841fb6d962818b3d63cf01a198d2e4b2bc050d51080f991b53c3ebe2c0
-
SHA512
05d04f0fa8323bbf58c1fa9b9a66d672573a57cddaa6f57cb00d136f3ee797ce8cc32d5365528b9b4ab44354e89f713d6e921641983f823757174ab5f70d63e8
-
SSDEEP
24576:0Vr4MROxnFE3+O3+rrcI0AilFEvxHPWooZ:0WMiuL+rrcI0AilFEvxHP
Score10/10-
Orcus main payload
-
Orcurs Rat Executable
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory
-