Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
32fb6efc9f3f4901cec09eba19168797147e91bff1cae8deadb84cf60c020801
-
Size
924KB
-
Sample
240108-bkh6lsaeh5
-
MD5
20deef4284ad2edfd11ff24f41eba5fc
-
SHA1
4a4712770f4a70937b5ca36e09b4daca6aa4e084
-
SHA256
32fb6efc9f3f4901cec09eba19168797147e91bff1cae8deadb84cf60c020801
-
SHA512
47c87cee5372c5b75f8d8938e7f94548d969e8014d22780d921ac43d4789b256e4c4be340aee59682d29788b16641fde57bc7335a6d53db419d32c6a96368109
-
SSDEEP
24576:XU64MROxnFE3sIMrrcI0AilFEvxHjfrIQ9:XUJMiupMrrcI0AilFEvxHj
Behavioral task
behavioral1
Sample
32fb6efc9f3f4901cec09eba19168797147e91bff1cae8deadb84cf60c020801.exe
Resource
win7-20231215-en
Malware Config
Extracted
orcus
nonamedc.mcv.kr:8080
2d5f462f00ed43cba223b57c0a9d157a
-
autostart_method
Registry
-
enable_keylogger
true
-
install_path
%programfiles%\WSupdate\WSupdate.exe
-
reconnect_delay
10000
-
registry_keyname
WSupdate
-
taskscheduler_taskname
WSupdates
-
watchdog_path
Temp\WSupdate.exe
Targets
-
-
Target
32fb6efc9f3f4901cec09eba19168797147e91bff1cae8deadb84cf60c020801
-
Size
924KB
-
MD5
20deef4284ad2edfd11ff24f41eba5fc
-
SHA1
4a4712770f4a70937b5ca36e09b4daca6aa4e084
-
SHA256
32fb6efc9f3f4901cec09eba19168797147e91bff1cae8deadb84cf60c020801
-
SHA512
47c87cee5372c5b75f8d8938e7f94548d969e8014d22780d921ac43d4789b256e4c4be340aee59682d29788b16641fde57bc7335a6d53db419d32c6a96368109
-
SSDEEP
24576:XU64MROxnFE3sIMrrcI0AilFEvxHjfrIQ9:XUJMiupMrrcI0AilFEvxHj
Score10/10-
Orcus main payload
-
Orcurs Rat Executable
-
Executes dropped EXE
-
Loads dropped DLL
-
Adds Run key to start application
-
Drops file in System32 directory
-