Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
10OrcusRAT-m...re.dll
windows7-x64
1OrcusRAT-m...re.dll
windows10-2004-x64
1OrcusRAT-m...as.dll
windows7-x64
1OrcusRAT-m...as.dll
windows10-2004-x64
1OrcusRAT-m...le.dll
windows7-x64
1OrcusRAT-m...le.dll
windows10-2004-x64
1OrcusRAT-m...pf.dll
windows7-x64
1OrcusRAT-m...pf.dll
windows10-2004-x64
1OrcusRAT-m...er.dll
windows7-x64
1OrcusRAT-m...er.dll
windows10-2004-x64
1OrcusRAT-m...op.dll
windows7-x64
1OrcusRAT-m...op.dll
windows10-2004-x64
1OrcusRAT-m...it.dll
windows7-x64
1OrcusRAT-m...it.dll
windows10-2004-x64
1OrcusRAT-m...ro.dll
windows7-x64
1OrcusRAT-m...ro.dll
windows10-2004-x64
1OrcusRAT-m...ks.dll
windows7-x64
1OrcusRAT-m...ks.dll
windows10-2004-x64
1OrcusRAT-m...il.dll
windows7-x64
1OrcusRAT-m...il.dll
windows10-2004-x64
1OrcusRAT-m...og.dll
windows7-x64
1OrcusRAT-m...og.dll
windows10-2004-x64
1OrcusRAT-m...on.dll
windows7-x64
1OrcusRAT-m...on.dll
windows10-2004-x64
1OrcusRAT-m...pf.dll
windows7-x64
1OrcusRAT-m...pf.dll
windows10-2004-x64
1OrcusRAT-m...ds.dll
windows7-x64
1OrcusRAT-m...ds.dll
windows10-2004-x64
1OrcusRAT-m...ng.dll
windows7-x64
1OrcusRAT-m...ng.dll
windows10-2004-x64
1OrcusRAT-m...ng.dll
windows7-x64
1OrcusRAT-m...ng.dll
windows10-2004-x64
1Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
01/11/2024, 15:57 UTC
Behavioral task
behavioral1
Sample
OrcusRAT-main/libraries/CSCore.dll
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
OrcusRAT-main/libraries/CSCore.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
OrcusRAT-main/libraries/Exceptionless.Extras.dll
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
OrcusRAT-main/libraries/Exceptionless.Extras.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
OrcusRAT-main/libraries/Exceptionless.Portable.dll
Resource
win7-20240708-en
Behavioral task
behavioral6
Sample
OrcusRAT-main/libraries/Exceptionless.Portable.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
OrcusRAT-main/libraries/Exceptionless.Wpf.dll
Resource
win7-20241010-en
Behavioral task
behavioral8
Sample
OrcusRAT-main/libraries/Exceptionless.Wpf.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
OrcusRAT-main/libraries/FluentCommandLineParser.dll
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
OrcusRAT-main/libraries/FluentCommandLineParser.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
OrcusRAT-main/libraries/GongSolutions.Wpf.DragDrop.dll
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
OrcusRAT-main/libraries/GongSolutions.Wpf.DragDrop.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
OrcusRAT-main/libraries/ICSharpCode.AvalonEdit.dll
Resource
win7-20240729-en
Behavioral task
behavioral14
Sample
OrcusRAT-main/libraries/ICSharpCode.AvalonEdit.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
OrcusRAT-main/libraries/MahApps.Metro.dll
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
OrcusRAT-main/libraries/MahApps.Metro.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
OrcusRAT-main/libraries/Microsoft.Threading.Tasks.dll
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
OrcusRAT-main/libraries/Microsoft.Threading.Tasks.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
OrcusRAT-main/libraries/Mono.Cecil.dll
Resource
win7-20241010-en
Behavioral task
behavioral20
Sample
OrcusRAT-main/libraries/Mono.Cecil.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
OrcusRAT-main/libraries/NLog.dll
Resource
win7-20241010-en
Behavioral task
behavioral22
Sample
OrcusRAT-main/libraries/NLog.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
OrcusRAT-main/libraries/Newtonsoft.Json.dll
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
OrcusRAT-main/libraries/Newtonsoft.Json.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
OrcusRAT-main/libraries/Ookii.Dialogs.Wpf.dll
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
OrcusRAT-main/libraries/Ookii.Dialogs.Wpf.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
OrcusRAT-main/libraries/Orcus.Administration.Commands.dll
Resource
win7-20240729-en
Behavioral task
behavioral28
Sample
OrcusRAT-main/libraries/Orcus.Administration.Commands.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
OrcusRAT-main/libraries/Orcus.Administration.Licensing.dll
Resource
win7-20240708-en
Behavioral task
behavioral30
Sample
OrcusRAT-main/libraries/Orcus.Administration.Licensing.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
OrcusRAT-main/libraries/Orcus.Administration.Licensing.dll
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
OrcusRAT-main/libraries/Orcus.Administration.Licensing.dll
Resource
win10v2004-20241007-en
General
-
Target
OrcusRAT-main/libraries/Mono.Cecil.dll
-
Size
274KB
-
MD5
6d6292bc8e698e53e69556add6f62442
-
SHA1
fab26eb07adab421797689da27ad754aa1c31810
-
SHA256
0f6465ce57a0cbabc37013c8e3c9f110672de1c127b6192177d59eb1c7809772
-
SHA512
f77c995857bf3c62bd87cce4246d9792d388af33664fbabf05bfcf574ae9332c45013697be7f698bff6cd33b02573abcbeae172b53c75979339e01123c61ae32
-
SSDEEP
6144:BaUU67x2AE6gaSTYUs8Nr/gaGGv8+iGKdJDkP0bAZ:biG8Nr/vv8+O
Malware Config
Signatures
Processes
Network
-
Remote address:8.8.8.8:53Request232.168.11.51.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request73.144.22.2.in-addr.arpaIN PTRResponse73.144.22.2.in-addr.arpaIN PTRa2-22-144-73deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request22.160.190.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request200.163.202.172.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request18.31.95.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request172.214.232.199.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request21.236.111.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Requesttse1.mm.bing.netIN AResponsetse1.mm.bing.netIN CNAMEmm-mm.bing.net.trafficmanager.netmm-mm.bing.net.trafficmanager.netIN CNAMEax-0001.ax-msedge.netax-0001.ax-msedge.netIN A150.171.27.10ax-0001.ax-msedge.netIN A150.171.28.10
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239340418570_1AILBHE008ZL9RHPC&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90Remote address:150.171.27.10:443RequestGET /th?id=OADD2.10239340418570_1AILBHE008ZL9RHPC&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 305259
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: D8585BD9E32F4B9BA575AF962354DEA6 Ref B: LON601060107036 Ref C: 2024-11-01T16:00:17Z
date: Fri, 01 Nov 2024 16:00:16 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239360615986_1M5N6Y5ACPFWCCI4D&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90Remote address:150.171.27.10:443RequestGET /th?id=OADD2.10239360615986_1M5N6Y5ACPFWCCI4D&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 712130
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: DD8CE5C09027443F81FCB6EC746F8BA8 Ref B: LON601060107036 Ref C: 2024-11-01T16:00:17Z
date: Fri, 01 Nov 2024 16:00:16 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317301149_1C7UDVEUE5Q4XJNTT&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90Remote address:150.171.27.10:443RequestGET /th?id=OADD2.10239317301149_1C7UDVEUE5Q4XJNTT&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 811388
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 3D2B9EDACC1E4FA4A3CCD19C70E153A5 Ref B: LON601060107036 Ref C: 2024-11-01T16:00:17Z
date: Fri, 01 Nov 2024 16:00:16 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239340418569_13408TD3CSPQQLS8W&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90Remote address:150.171.27.10:443RequestGET /th?id=OADD2.10239340418569_13408TD3CSPQQLS8W&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 815230
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 9D6524C244D84BA99EFED5FF0EE7903E Ref B: LON601060107036 Ref C: 2024-11-01T16:00:17Z
date: Fri, 01 Nov 2024 16:00:16 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239360615987_16QLWX2YIZJRGGD7R&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90Remote address:150.171.27.10:443RequestGET /th?id=OADD2.10239360615987_16QLWX2YIZJRGGD7R&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 258855
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 55EBAD7063F74A58B59C23DC640CADFD Ref B: LON601060107036 Ref C: 2024-11-01T16:00:17Z
date: Fri, 01 Nov 2024 16:00:16 GMT
-
GEThttps://tse1.mm.bing.net/th?id=OADD2.10239317301558_105IVW87X3HJ5L2KP&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90Remote address:150.171.27.10:443RequestGET /th?id=OADD2.10239317301558_105IVW87X3HJ5L2KP&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
host: tse1.mm.bing.net
accept: */*
accept-encoding: gzip, deflate, br
user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
ResponseHTTP/2.0 200
content-length: 889516
content-type: image/jpeg
x-cache: TCP_HIT
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-methods: GET, POST, OPTIONS
timing-allow-origin: *
report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
x-msedge-ref: Ref A: 3D556C44098D427A838845B8BC44D5F3 Ref B: LON601060107036 Ref C: 2024-11-01T16:00:22Z
date: Fri, 01 Nov 2024 16:00:21 GMT
-
Remote address:8.8.8.8:53Request120.150.79.40.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request120.150.79.40.in-addr.arpaIN PTR
-
1.1kB 6.8kB 13 10
-
1.1kB 6.8kB 13 10
-
150.171.27.10:443https://tse1.mm.bing.net/th?id=OADD2.10239317301558_105IVW87X3HJ5L2KP&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90tls, http2137.2kB 4.0MB 2920 2905
HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239340418570_1AILBHE008ZL9RHPC&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239360615986_1M5N6Y5ACPFWCCI4D&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317301149_1C7UDVEUE5Q4XJNTT&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239340418569_13408TD3CSPQQLS8W&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239360615987_16QLWX2YIZJRGGD7R&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90HTTP Response
200HTTP Response
200HTTP Request
GET https://tse1.mm.bing.net/th?id=OADD2.10239317301558_105IVW87X3HJ5L2KP&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90HTTP Response
200HTTP Response
200HTTP Response
200HTTP Response
200 -
1.7kB 11.1kB 21 14
-
1.9kB 6.9kB 21 13
-
72 B 158 B 1 1
DNS Request
232.168.11.51.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
73.144.22.2.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
22.160.190.20.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa
-
74 B 160 B 1 1
DNS Request
200.163.202.172.in-addr.arpa
-
70 B 144 B 1 1
DNS Request
18.31.95.13.in-addr.arpa
-
74 B 128 B 1 1
DNS Request
172.214.232.199.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
21.236.111.52.in-addr.arpa
-
62 B 170 B 1 1
DNS Request
tse1.mm.bing.net
DNS Response
150.171.27.10150.171.28.10
-
144 B 146 B 2 1
DNS Request
120.150.79.40.in-addr.arpa
DNS Request
120.150.79.40.in-addr.arpa