Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Behavioral task
behavioral1
Sample
O1.exe
Resource
win7-20240708-en
General
-
Target
O1.exe
-
Size
3.0MB
-
MD5
5b981f0c4df0ac1e4ac7044efd855ef3
-
SHA1
1a916b685f846e9bdbd14c789e098dcd442adf7d
-
SHA256
fc9f450bc1927e864a5f9cad97642515b5daeab7f35ed85257a1b82f4a7ae844
-
SHA512
48d1ff7f2e607cc634c2ec9e5c776b166a923a08595e2446b47fc42bd322d632d77526da2b72ca041e591c09cf2f5ab70809b3488ba2ca59437b14cefd01417e
-
SSDEEP
49152:F74R0QyXQrZeM9/FMDjjVZFGFeHzHt5AmYAypQxbJyBBo9JnCmwWncFf0I74gu3l:Fc2KQ4MDjZZF08t5AmXypSbMBo9JCm
Malware Config
Extracted
orcus
h2xo9w.ddns.net:10134
df6697f408f645e0adc2ec3085681727
-
autostart_method
TaskScheduler
-
enable_keylogger
true
-
install_path
%appdata%\Antimalware Service\Antimalware Service.exe
-
reconnect_delay
10000
-
registry_keyname
Antimalware Service
-
taskscheduler_taskname
Antimalware Service
-
watchdog_path
AppData\Antimalware Service Helper.exe
Signatures
-
Orcurs Rat Executable 1 IoCs
resource yara_rule sample orcus -
Orcus family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource O1.exe
Files
-
O1.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
Imports
mscoree
_CorExeMain
Sections
.text Size: 2.9MB - Virtual size: 2.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ