Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
5a7e4eb21012621383ec2a556e63202d42334c02da350c1eaa7af7d1c9088691
-
Size
3.0MB
-
Sample
240127-bplsasacb6
-
MD5
f210202bfa18db14c6ec346037e4cb64
-
SHA1
be0a794a92753d152eebf2c9478da14156d1084f
-
SHA256
5a7e4eb21012621383ec2a556e63202d42334c02da350c1eaa7af7d1c9088691
-
SHA512
a6b5d64679a0a52a1357ae23890ee324788c2fedfcb03059f9d083ae423df060a93983053a277a3f577b296821754596cd0b876d160a309b888569cde738a49d
-
SSDEEP
49152:Y1HS7p1EZKMnkmWg8LX5prviYDyKS5AypQxbRQAo9JnCmpbu/nRFfjI7L0qb:YUHTPJg8z1mKnypSbRxo9JCm
Behavioral task
behavioral1
Sample
5a7e4eb21012621383ec2a556e63202d42334c02da350c1eaa7af7d1c9088691.exe
Resource
win7-20231215-en
Malware Config
Extracted
orcus
Новый тег
31.44.184.52:23303
sudo_ofcp37vv54izlwrf1h65z8l5gj4mqi71
-
autostart_method
Disable
-
enable_keylogger
false
-
install_path
%appdata%\toprocessorcdn\local_.exe
-
reconnect_delay
10000
-
registry_keyname
Sudik
-
taskscheduler_taskname
sudik
-
watchdog_path
AppData\aga.exe
Targets
-
-
Target
5a7e4eb21012621383ec2a556e63202d42334c02da350c1eaa7af7d1c9088691
-
Size
3.0MB
-
MD5
f210202bfa18db14c6ec346037e4cb64
-
SHA1
be0a794a92753d152eebf2c9478da14156d1084f
-
SHA256
5a7e4eb21012621383ec2a556e63202d42334c02da350c1eaa7af7d1c9088691
-
SHA512
a6b5d64679a0a52a1357ae23890ee324788c2fedfcb03059f9d083ae423df060a93983053a277a3f577b296821754596cd0b876d160a309b888569cde738a49d
-
SSDEEP
49152:Y1HS7p1EZKMnkmWg8LX5prviYDyKS5AypQxbRQAo9JnCmpbu/nRFfjI7L0qb:YUHTPJg8z1mKnypSbRxo9JCm
-
Orcus main payload
-
Orcurs Rat Executable
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
Suspicious use of SetThreadContext
-