Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

OrcusLauncher.exe

windows10-ltsc 2021-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    OrcusLauncher.exe

  • Size

    839KB

  • Sample

    250115-b46e9aylhq

  • MD5

    b931bd63c8f3fbed9812df37a55c50f8

  • SHA1

    471352d83479f815e64b8fdedca6a243bb176514

  • SHA256

    2c770ee8abfe03bbf7206c9a72f252378fe22b06c88a4788464eb2d8eecdd447

  • SHA512

    3a169ccf14f1b78db7116c3e8b709e1e3aed0585036812e98e6813b799e556a917da7c39c2b14b6ba6e96a27c0ded65ea9217c9dad62ff2c619b8a0c0a97b3c7

  • SSDEEP

    24576:lmIS04YNEMuExDiU6E5R9s8xY/2l/detnIbt+rb:oQ4auS+UjfU2TedIbt+r

Score
10/10
orcusdiscoveryratspywarestealer

Malware Config

Extracted

Family

orcus

C2

hi-tin.gl.at.ply.gg

Mutex

e1739ca6803f4a20a3dfac72cfbc1100

Attributes
  • administration_rights_required

    false

  • anti_debugger

    false

  • anti_tcp_analyzer

    false

  • antivm

    false

  • autostart_method

    1

  • change_creation_date

    false

  • force_installer_administrator_privileges

    false

  • hide_file

    false

  • install

    false

  • installation_folder

    %appdata%\Microsoft\Speech\AudioDriver.exe

  • installservice

    false

  • keylogger_enabled

    false

  • newcreationdate

    01/14/2025 22:12:00

  • plugins

    AgEAAA==

  • reconnect_delay

    10000

  • registry_autostart_keyname

    Audio HD Driver

  • registry_hidden_autostart

    false

  • set_admin_flag

    false

  • tasksch_name

    Audio HD Driver

  • tasksch_request_highest_privileges

    false

  • try_other_autostart_onfail

    false

aes.plain
1
CrackedByWardow

Targets

    • Target

      OrcusLauncher.exe

    • Size

      839KB

    • MD5

      b931bd63c8f3fbed9812df37a55c50f8

    • SHA1

      471352d83479f815e64b8fdedca6a243bb176514

    • SHA256

      2c770ee8abfe03bbf7206c9a72f252378fe22b06c88a4788464eb2d8eecdd447

    • SHA512

      3a169ccf14f1b78db7116c3e8b709e1e3aed0585036812e98e6813b799e556a917da7c39c2b14b6ba6e96a27c0ded65ea9217c9dad62ff2c619b8a0c0a97b3c7

    • SSDEEP

      24576:lmIS04YNEMuExDiU6E5R9s8xY/2l/detnIbt+rb:oQ4auS+UjfU2TedIbt+r

    Score
    10/10
    orcusdiscoveryratspywarestealer

    • Orcus

      Orcus is a Remote Access Trojan that is being sold on underground forums.

      ratspywarestealerorcus

    • Orcus family

      orcus

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Executes dropped EXE

    • Drops desktop.ini file(s)

    behavioral1

MITRE ATT&CK Enterprise v15

Tasks

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.