Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

1

URLScan

urlscan

https://github.com/B...

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    https://github.com/BlitzedOfficial/BlitzedGrabberV12/releases/download/BlitzedGrabberV12/BlitzedGrabberV12.rar

  • Sample

    240505-rzhfmafh89

Score
10/10
orcusagilenetdiscoveryexecutionpersistenceratspywarestealer

Malware Config

Extracted

Family

orcus

C2

209.25.141.181:40489

Mutex

248d60d8a7114264bce951ca45664b1d

Attributes
  • autostart_method

    TaskScheduler

  • enable_keylogger

    true

  • install_path

    %programdata%\Chrome\chromedriver.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    winlogon.exe

  • watchdog_path

    AppData\svchost.exe

Targets

    • Target

      https://github.com/BlitzedOfficial/BlitzedGrabberV12/releases/download/BlitzedGrabberV12/BlitzedGrabberV12.rar

    Score
    10/10
    orcusagilenetdiscoveryexecutionpersistenceratspywarestealer

    • Orcus

      Orcus is a Remote Access Trojan that is being sold on underground forums.

      ratspywarestealerorcus

    • Orcus main payload

    • Orcurs Rat Executable

    • Executes dropped EXE

    • Loads dropped DLL

    • Obfuscated with Agile.Net obfuscator

      Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

      agilenet

    • Registers COM server for autorun

      persistence

    • Adds Run key to start application

      persistence

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery

    • Drops desktop.ini file(s)

    • Drops file in System32 directory

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.