Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

da79b06e95...22.exe

windows7-x64

10

da79b06e95...22.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    da79b06e9569d27dcbdf45f8b3dee8a7b5e74ac1c6a35dcdf8909dc7e372d622

  • Size

    907KB

  • Sample

    240107-bfz9bscha7

  • MD5

    fe72a29c3b2ac5e7d210a0ebe2fc4770

  • SHA1

    396d80f0ed22547ebe88bfa80ab8b0e3c80cb045

  • SHA256

    da79b06e9569d27dcbdf45f8b3dee8a7b5e74ac1c6a35dcdf8909dc7e372d622

  • SHA512

    df077ac0347bbc121cf93d703d510b76077aa7b7df4cf649bd5e464d315ad8f934c67ebbb8e26b9cc147043cc6fa4c36712f0ced521b51bbd3b2c744b44adb3f

  • SSDEEP

    12288:50XCGPSX0zbyD+ndg+QCImGYUl9qyzlkE2kUNCOcpCwFu/7u2pExO9u7dG1lFlW1:ncS4MROxnF2xPrrcI0AilFEvxHj8xQJ

Score
10/10
orcusratspywarestealer

Malware Config

Extracted

Family

orcus

C2

nonamedc.mcv.kr:80

Mutex

ecce2d674bcb411599c6f4e988c6a8b5

Attributes
  • autostart_method

    Disable

  • enable_keylogger

    false

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\OrcusWatchdog.exe

Targets

    • Target

      da79b06e9569d27dcbdf45f8b3dee8a7b5e74ac1c6a35dcdf8909dc7e372d622

    • Size

      907KB

    • MD5

      fe72a29c3b2ac5e7d210a0ebe2fc4770

    • SHA1

      396d80f0ed22547ebe88bfa80ab8b0e3c80cb045

    • SHA256

      da79b06e9569d27dcbdf45f8b3dee8a7b5e74ac1c6a35dcdf8909dc7e372d622

    • SHA512

      df077ac0347bbc121cf93d703d510b76077aa7b7df4cf649bd5e464d315ad8f934c67ebbb8e26b9cc147043cc6fa4c36712f0ced521b51bbd3b2c744b44adb3f

    • SSDEEP

      12288:50XCGPSX0zbyD+ndg+QCImGYUl9qyzlkE2kUNCOcpCwFu/7u2pExO9u7dG1lFlW1:ncS4MROxnF2xPrrcI0AilFEvxHj8xQJ

    Score
    10/10
    orcusratspywarestealer

    • Orcus

      Orcus is a Remote Access Trojan that is being sold on underground forums.

      ratspywarestealerorcus

    • Orcurs Rat Executable

    behavioral1behavioral2

MITRE ATT&CK Matrix

Tasks