Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

0e51360d1c...48.exe

windows7-x64

10

0e51360d1c...48.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    0e51360d1c23f3af4cec6dfd7b60c5c96f6385d4ff8c3dd78c106cbe47f2c648

  • Size

    1.1MB

  • Sample

    250210-bhdhcayjf1

  • MD5

    72965d77801883401185b35022256134

  • SHA1

    834c839d822e014c1c365648a8ad237a315b90f7

  • SHA256

    0e51360d1c23f3af4cec6dfd7b60c5c96f6385d4ff8c3dd78c106cbe47f2c648

  • SHA512

    ddaca3e51957bafea26a9bef01d8d2f21c47b6250bcf958ba417ac0aa20de8152ad51fce34910822b5b522c9e5e210947a883c0a4336bb9434389d52f4234c45

  • SSDEEP

    24576:/1X4MROxnFHOVrrcI0AilFEvxHPWLoo2UDBw9g3HkK:/+MiJ8rrcI0AilFEvxHPW4UDBw9g3k

Score
10/10
orcusdiscoveryratspywarestealer

Malware Config

Extracted

Family

orcus

C2

192.168.1.91:10134

Mutex

dfed88ab19b146219f7441fec43f520c

Attributes
  • autostart_method

    Disable

  • enable_keylogger

    true

  • install_path

    %programfiles%\Orcus\Orcus.exe

  • reconnect_delay

    10000

  • registry_keyname

    Orcus

  • taskscheduler_taskname

    Orcus

  • watchdog_path

    AppData\OrcusWatchdog.exe

Targets

    • Target

      0e51360d1c23f3af4cec6dfd7b60c5c96f6385d4ff8c3dd78c106cbe47f2c648

    • Size

      1.1MB

    • MD5

      72965d77801883401185b35022256134

    • SHA1

      834c839d822e014c1c365648a8ad237a315b90f7

    • SHA256

      0e51360d1c23f3af4cec6dfd7b60c5c96f6385d4ff8c3dd78c106cbe47f2c648

    • SHA512

      ddaca3e51957bafea26a9bef01d8d2f21c47b6250bcf958ba417ac0aa20de8152ad51fce34910822b5b522c9e5e210947a883c0a4336bb9434389d52f4234c45

    • SSDEEP

      24576:/1X4MROxnFHOVrrcI0AilFEvxHPWLoo2UDBw9g3HkK:/+MiJ8rrcI0AilFEvxHPW4UDBw9g3k

    Score
    10/10
    orcusdiscoveryratspywarestealer

    • Orcus

      Orcus is a Remote Access Trojan that is being sold on underground forums.

      ratspywarestealerorcus

    • Orcus family

      orcus

    • Orcurs Rat Executable

    • Downloads MZ/PE file

    behavioral1behavioral2

MITRE ATT&CK Enterprise v15

Tasks