Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

c5ad23faa6...2N.exe

windows7-x64

10

c5ad23faa6...2N.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    c5ad23faa63952a9c2a6f26fdbc0996bf7b44ba0c566b209a9fa0ffd97404cd2N

  • Size

    3.0MB

  • MD5

    5487d71c19c09ded835191e89feba640

  • SHA1

    6c13f1e61e8cf66ae728a53c49497899def41092

  • SHA256

    c5ad23faa63952a9c2a6f26fdbc0996bf7b44ba0c566b209a9fa0ffd97404cd2

  • SHA512

    0d17303a9bc1903d298eb5d6cc8d1d36bfa1950c9fe14d8d03623381c5d4f75f5e6eb376474b4d67081906630459be4374a980992622515b3646170b8b8f6181

  • SSDEEP

    49152:dsFN8QFUwqYZeM9/ZzzBjMkPUayX82+YXAypQxb9ndo9JnCmwWncFf0I74gu3+SM:do0wGGzBjryX82uypSb9ndo9JCm

Score
10/10
orcus

Malware Config

Extracted

Family

orcus

C2

voidsystems.duckdns.org:23210

Mutex

db2de9eb436a494988e51052087353b5

Attributes
  • autostart_method

    TaskScheduler

  • enable_keylogger

    false

  • install_path

    %programfiles%\KernelGuard\SafeGuard.exe

  • reconnect_delay

    10000

  • registry_keyname

    KernelEncryptionProtocolKEP

  • taskscheduler_taskname

    SafeGuard

  • watchdog_path

    AppData\KernelAntiLoopGuard

Signatures

  • Orcurs Rat Executable 1 IoCs
  • Orcus family
    orcus
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • c5ad23faa63952a9c2a6f26fdbc0996bf7b44ba0c566b209a9fa0ffd97404cd2N
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.