Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Behavioral task
behavioral1
Sample
ed795fc70ee5ad17c07d508bd246dbd06f1b7b31b658de430ad624349e9d8059.exe
Resource
win7-20240215-en
General
-
Target
ed795fc70ee5ad17c07d508bd246dbd06f1b7b31b658de430ad624349e9d8059
-
Size
1.1MB
-
MD5
1f9764861e8d9f9abf023df85266ffbf
-
SHA1
b0c4fe71402fbdbf6766764c1bcbf90690b492f5
-
SHA256
ed795fc70ee5ad17c07d508bd246dbd06f1b7b31b658de430ad624349e9d8059
-
SHA512
3cab62821c840c55d5f3649695906d62aad10f7cc697c071916e6da01316d72910be2187ced73306b7adacaaa70362317d98657e3b8083d01c1c37e05cace7f6
-
SSDEEP
24576:CDN4MROxnFi3csSrrcI0AilFEvxHPpooPF:CuMioRSrrcI0AilFEvxHP3
Malware Config
Extracted
orcus
}{ERTVA
0.0.0.0:1268
d09e3406273e4b918a3fae435fcb264c
-
autostart_method
Registry
-
enable_keylogger
false
-
install_path
%programfiles%\Orcus\Wincorgs.exe
-
reconnect_delay
10000
-
registry_keyname
Wineyes
-
taskscheduler_taskname
wineyes
-
watchdog_path
AppData\Eyesmgr.exe
Signatures
-
Orcurs Rat Executable 1 IoCs
resource yara_rule sample orcus -
Orcus family
-
Orcus main payload 1 IoCs
resource yara_rule sample family_orcus -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource ed795fc70ee5ad17c07d508bd246dbd06f1b7b31b658de430ad624349e9d8059
Files
-
ed795fc70ee5ad17c07d508bd246dbd06f1b7b31b658de430ad624349e9d8059.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 913KB - Virtual size: 912KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 164KB - Virtual size: 163KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ