Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

7b9f174ec0...b8.exe

windows7-x64

10

7b9f174ec0...b8.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    7b9f174ec0e6bcd199131ffaa876aa6c84a1233bb12d62c2851ab7e950fb39b8

  • Size

    924KB

  • MD5

    341714db087bd7bfe3d65cab7dccb3b7

  • SHA1

    1c2f9668fe0d6e548570064ad1f5349239c88761

  • SHA256

    7b9f174ec0e6bcd199131ffaa876aa6c84a1233bb12d62c2851ab7e950fb39b8

  • SHA512

    05df013b6cbc310e61b36fd77475802c465f2fc0a64bcae744518de73b91e14a51506cec08e30f9aad12b02d9e81e56462fd54a656aad3306293b1a53da6bf09

  • SSDEEP

    24576:bCC4MROxnFE3mi+rrcI0AilFEvxHP+ooM:bKMiup+rrcI0AilFEvxHP

Score
10/10
test_leo_fakeorcus

Malware Config

Extracted

Family

orcus

Botnet

TEST_LEO_FAKE

C2

0.0.0.0:1268

Mutex

4b7e745d24cf405ca3d04bd10e33b1c6

Attributes
  • autostart_method

    Registry

  • enable_keylogger

    true

  • install_path

    %programfiles%\Windows_Defender\Defender.exe

  • reconnect_delay

    10000

  • registry_keyname

    W_Defender

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\Defender.exe

Signatures

  • Orcurs Rat Executable 1 IoCs
  • Orcus family
    orcus
  • Orcus main payload 1 IoCs
  • Unsigned PE 1 IoCs

    Checks for missing Authenticode signature.

Files

  • 7b9f174ec0e6bcd199131ffaa876aa6c84a1233bb12d62c2851ab7e950fb39b8
    .exe windows:4 windows x86 arch:x86

    f34d5f2d4577ed6d9ceec516c1f5a744


    Headers

    Imports

    Sections

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.