Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
General
-
Target
0b73bf9b3a7e38ea9648a62f8a31e1c19396ed0dc24a08d8dba7412f9ca224e8
-
Size
919KB
-
Sample
250131-brfdasxjfz
-
MD5
a8460e01638dddbbb2ab4ea7d90d67b7
-
SHA1
812d25d53995a93e91e519a7827e7ce90abbbd22
-
SHA256
0b73bf9b3a7e38ea9648a62f8a31e1c19396ed0dc24a08d8dba7412f9ca224e8
-
SHA512
82541b1cc204273be276c4abe017583d3a592e113b1926251e7fdb1b2ef2dde36ec3ba4cf9f6706fa897eb1be5c42bc044b117c7df0f9cfe283b44fb3aed1c6a
-
SSDEEP
24576:AKW4MROxnFi3+serrcI0AilFEvxHPwfoos:AOMio/errcI0AilFEvxHP
Behavioral task
behavioral1
Sample
0b73bf9b3a7e38ea9648a62f8a31e1c19396ed0dc24a08d8dba7412f9ca224e8.exe
Resource
win7-20240903-en
Malware Config
Extracted
orcus
programme-commission.gl.at.ply.gg:32324
47fb5452117446319e9848a0ce452618
-
autostart_method
Registry
-
enable_keylogger
true
-
install_path
%programfiles%\Microsoft 365
-
reconnect_delay
10000
-
registry_keyname
svchost
-
taskscheduler_taskname
RtkAudUService64
-
watchdog_path
AppData\svchost.exe
Targets
-
-
Target
0b73bf9b3a7e38ea9648a62f8a31e1c19396ed0dc24a08d8dba7412f9ca224e8
-
Size
919KB
-
MD5
a8460e01638dddbbb2ab4ea7d90d67b7
-
SHA1
812d25d53995a93e91e519a7827e7ce90abbbd22
-
SHA256
0b73bf9b3a7e38ea9648a62f8a31e1c19396ed0dc24a08d8dba7412f9ca224e8
-
SHA512
82541b1cc204273be276c4abe017583d3a592e113b1926251e7fdb1b2ef2dde36ec3ba4cf9f6706fa897eb1be5c42bc044b117c7df0f9cfe283b44fb3aed1c6a
-
SSDEEP
24576:AKW4MROxnFi3+serrcI0AilFEvxHPwfoos:AOMio/errcI0AilFEvxHP
-
Orcus family
-
Orcus main payload
-
Orcurs Rat Executable
-