General
-
Target
OrcusRAT-main.zip
-
Size
25.0MB
-
Sample
240910-mzqd1ssakb
-
MD5
4ebe8621171038676189cbc5e7053d9f
-
SHA1
2e3a3b97163d1e8af1e41c36f9495062fb4b1934
-
SHA256
3786d314f4e3906400b24657ed15fca047576eba9cf17630246db69503fdbea3
-
SHA512
e0091ae9f3acddc7e8d11b89a60debc3dab57b8af57bde4a3f538b2283eae398a1adec8224bf5fd2d0be61be015fc2a79c49b06cf786945073e1cc87d66be356
-
SSDEEP
786432:DFrAoo07VJxiSdlBx4IVwXuOHKW3kijZk:hrA+xJBgIEuMUiNk
Malware Config
Targets
-
-
Target
OrcusRAT-main/How To Open Port All Tutorial.url
-
Size
96B
-
MD5
e6e103fb45cbe55836826bc3410efcc0
-
SHA1
ff589e9f655d3368571562711b954f301615d457
-
SHA256
99e7a2772fa7b583be865188c49e15d8294569d820bb29be95cee538a6a5f494
-
SHA512
d41fa5eb682f9c2a1eddcac0a79cdda9f7228b9080c843ce5e7aa1ef027f8c773733faa471e44ca76a37e405d5488c29f34e1785f149115bd65f01fb3b52acb7
Score1/10 -
-
-
Target
OrcusRAT-main/How To Setup a Rat.url
-
Size
96B
-
MD5
8d61646db59cc7460b40bc79001a40a1
-
SHA1
e43cdfb3d27a0cb4b4532053c27810abf06d415e
-
SHA256
c5d1bc7427609e082195ad8db57c9b35b274e3df63a92d78917334425730d1e7
-
SHA512
9eef7dcaa96a52d52caff6b9709f8377437ff201e976761eec8c35669f946ef111d7da9528c8f253f469969513e4ec5e6a5d0b861665254a6564f8c2d85d9f99
Score1/10 -
-
-
Target
OrcusRAT-main/Orcus.Administration.exe
-
Size
16.2MB
-
MD5
a6347e4e194adb6d2a3fae52598d8cdd
-
SHA1
aa06c496c20d6e04142d4a5205a032680a452a0d
-
SHA256
911e3e95efddbae9d1c2f4b04027567c76823116755097b5868b7241c7e30cbc
-
SHA512
2ee24604c0edbc09096e2344ca6c1f74b1067b9aff7f077d0b4e42cd8f51dd1116e98016e34f0a1d951fcdbc8bfed33b1709a9692ba95b3ea3cd84d9ce080922
-
SSDEEP
393216:3pC4606R60B8vYfZ9DfZ9DSK7SftLaeH+:sJOcPLPte
Score10/10-
Orcus
Orcus is a Remote Access Trojan that is being sold on underground forums.
-
Orcurs Rat Executable
-
Loads dropped DLL
-
-
-
Target
OrcusRAT-main/Uninstall.exe
-
Size
101KB
-
MD5
4143d3bb52f6ca4aea06d4ae15db611f
-
SHA1
be6b949ed7be8ce752b7343d56d9c3f96b25a0d3
-
SHA256
1ff448e9e456f5ad022c2bffb16e0e94eeb6346e8befab695ec0f369349a1a0a
-
SHA512
2a9befa77e042ea32358c8e3c40e67b3ebf618744634878393a7f7121484371dd62f5d981d0aaef2280bb1a574379271abaf249708ed49b893924fb521cbd2d2
-
SSDEEP
1536:zO/z6hPABUjO/Zd1716EoLiL4l1HdIaqQPDm0xK8i6f0Zn9PRVW8sW45o7Nkn:kzgjO/Zd1RePDmZ8tf05iW4uM
Score7/10-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE
-
Loads dropped DLL
-
-
-
Target
OrcusRAT-main/libraries/AlphaChiTech.Virtualization.dll
-
Size
51KB
-
MD5
66c29815e0e824874e69342fe344d460
-
SHA1
0c50bf0f38d1577172e534483768368288a59753
-
SHA256
5a9296146dd3d0dca9507e59520c29ef9848cbd7599a95efe09c01fa1c894d8a
-
SHA512
be9649d8a7b21c4b784df91b6694f6f0ca698ca8484cb6232659123dbfc4908e1a74a100f43b34c9473d998d8565bc86dff3f46978e93c7fa9285128a97b096a
-
SSDEEP
1536:w57kU/A3fmKsyZWxRkHEYuMHsN5JdGoSoD2Rg2:w5EsyZtROFDmg2
Score1/10 -
-
-
Target
OrcusRAT-main/libraries/Be.Windows.Forms.HexBox.dll
-
Size
77KB
-
MD5
e00907b3d9270d4cca87c25ff30bcd02
-
SHA1
c59a191e9d0180530af19749b16f6382d410b322
-
SHA256
5448e587498c560ef1d8e182344bc340a57cfd3b05c4507c48da11e139035818
-
SHA512
73ee810bef992fab54cdb4ada648b2b32ba17f94076f3c079c57e97a0a62193a9a7d5745c454744b380bae2ba447b23556604765410929521260946ef73e7fb1
-
SSDEEP
1536:jcF2tarjL/jyH9oHPvH3f5rhZ3rmGAp16RHJjGccjOthSXlOhZnTFp8k7kXk5GLd:jhtt9oGjOt8XlOh/zziR
Score1/10 -
-
-
Target
OrcusRAT-main/libraries/CSCore.dll
-
Size
496KB
-
MD5
5e8fe2a84d3076f5d9815b77eb67d4f6
-
SHA1
c08f0f706520e1a32b0999bda032c90755f7d374
-
SHA256
fd3feefc62097ff785c7fdd524070e25fcaba7e4ce19f5480ecad695dd2a5405
-
SHA512
8a5e77aa6f31db39dae45dbb2dc45da717a065f6831552b0133f6defe6551e236226acfc5dfecc93dad1a3457720d8f85a985c71a7591d45755c3f8ff4740438
-
SSDEEP
6144:qgnuf8G18h9LKXYTD+XVyX6QgYC/f98+5JBO5blpIz0oG2th9i/J:qgFBKcDFXDgYC/f987Kz19i/
Score1/10 -
-
-
Target
OrcusRAT-main/libraries/ICSharpCode.AvalonEdit.dll
-
Size
592KB
-
MD5
d7467d0156f22feb4b22cc5f74d7bd60
-
SHA1
bcc1d959786ba4253491b67d448f97cf5ad709ed
-
SHA256
2bf6079c143f177d954731db2ffde515bee8fbd6261e0d338ba8e7c8df1ab658
-
SHA512
f13092a4154524226900c8f3089ef776932cae601cb21cc10af1111014aef97a1183a2344da3f5b8f5b9fbe8b4b420412d79b71e97a1b4ed2ec384b502ba1c28
-
SSDEEP
6144:64Gybj4PJqJZD0JOi0Av5+ENJzHLeDjN3kNHjoJAo7gOfwlflvuSn:6i4PwJZ1szeDjKRWwl5
Score1/10 -
-
-
Target
OrcusRAT-main/libraries/MahApps.Metro.dll
-
Size
918KB
-
MD5
fb1e8eee84791cc015e043ab0ce32bba
-
SHA1
42fb789011213635a7d022ba4fd5461a0d9a134d
-
SHA256
0de72da4bc2d16d39c30368af880d754fa0bd9745897652ba50213e589d265c5
-
SHA512
748af415c875cd5d44f305cf58060e7e66ef2ef041b6e86e3a76287a51af63116096eaed0877dc48c17da6594ad0c8dbf0ecadecb763dd469be8b6cc1d02d4a0
-
SSDEEP
12288:qADBZgu6aCRVudOz7A+H/uzylD/AcnnnnnnnnnnnnnnnnnnnnnnnGnknnnnnAMxg:qYMRMOzjuuF/AmHRNXmbJtV/
Score1/10 -
-
-
Target
OrcusRAT-main/libraries/Microsoft.Threading.Tasks.dll
-
Size
36KB
-
MD5
d01819bfe03222dfa9e35a36555b6b6c
-
SHA1
25f8069590b14724f28e6a04b8a42e4ef4a8562d
-
SHA256
5f29e16edff5379e93d5be9bee4cddf98132b84326027688511ac0f3157aaf94
-
SHA512
e63901f39315972e446768f2c14b4279cf1dd382f97ac90c444c4d858c2a486736a259c47245026b11e5c0846310e7da020bf2466ea91aa0a15d22cb67b37477
-
SSDEEP
384:AjCan21RTf1FuPIgbSVHfiWvoVZHL+8SChE+QNEv4USWyWcWZ1q//0GftpBjfuHk:A+e21RTrgbSpfihdvF4eg8iUHWTmlr+
Score1/10 -
-
-
Target
OrcusRAT-main/libraries/Mono.Cecil.dll
-
Size
274KB
-
MD5
6d6292bc8e698e53e69556add6f62442
-
SHA1
fab26eb07adab421797689da27ad754aa1c31810
-
SHA256
0f6465ce57a0cbabc37013c8e3c9f110672de1c127b6192177d59eb1c7809772
-
SHA512
f77c995857bf3c62bd87cce4246d9792d388af33664fbabf05bfcf574ae9332c45013697be7f698bff6cd33b02573abcbeae172b53c75979339e01123c61ae32
-
SSDEEP
6144:BaUU67x2AE6gaSTYUs8Nr/gaGGv8+iGKdJDkP0bAZ:biG8Nr/vv8+O
Score1/10 -
-
-
Target
OrcusRAT-main/libraries/NLog.dll
-
Size
517KB
-
MD5
27c2b96dfbebba578638588d2c95705f
-
SHA1
6223920526982da59a93ccb2d733e9bdbb1afbaf
-
SHA256
a74414ee5a23d73d879c216d9cfd96a9a8ad048773fe689d8a8b3022c9869cdf
-
SHA512
aa90ef4fef936a43c3413c90427668b7956742bb88eb2693d8dc23654952997771e702f5c0b8ffa04e8f0ef8e16809d8bb3ac1f007bc9989b039e78a1d2a6358
-
SSDEEP
12288:PNShT6DUsQfOrYqk1CXQdcGASuocRwsCbDRHDh:cNEUsQfOrYqk1CXQdcGASuocRwsCbDRl
Score1/10 -
-
-
Target
OrcusRAT-main/libraries/Newtonsoft.Json.dll
-
Size
510KB
-
MD5
c3c04754418382f505cafc18d64427f5
-
SHA1
cac5e36dc498d6bb16170020be021ff5bd18a9e2
-
SHA256
df8ec2e0245829ddec5b79f1918c3ae3a3fa540a5a0e3c410e2b6ef0bebc7927
-
SHA512
bda5efd0f69a9c7198841e5d31744fa2bebb05cedb1e2846a0d2dbce6c3193da69c181be1116f38cd5f3d61b441567b1da2c844522184323e3d429294aa91ab5
-
SSDEEP
6144:D5AGNDJNY1d2Skc39wf9IsDraDmh7JKH8Vjp4baBmBFSu4oNVg2OUvie:LNYNY9LaDKKGSBTV9
Score1/10 -
-
-
Target
OrcusRAT-main/libraries/Ookii.Dialogs.Wpf.dll
-
Size
105KB
-
MD5
5926472580c7a7b45cd611dc0fb06244
-
SHA1
a3b33bc8c9963f727bc2a2714ec6de0c607bca40
-
SHA256
04b8cb55ff481a4f4f9a60bc3c5e06ed78c12a8677c211621edcf9d8467bd823
-
SHA512
be05b4695896b4a2ad2ca63836c9d05084b8aa1b71929e1b081fd47b851282438bdf8c7bc65466ce7f3fe30335e743c0bd12aa52670b12d6eaec8b3bfd193056
-
SSDEEP
1536:5lPwQgrQnQaIM9MsmdgdSrtP7QdniuLF+mnNuu48pMBqDALYHu+an+HeaP6kOdWF:5lNJIceEMGFHnM8A8HC++aPA3O
Score1/10 -
-
-
Target
OrcusRAT-main/libraries/Orcus.Administration.Commands.dll
-
Size
106KB
-
MD5
bca25796ab6eaced997fe584d561ab78
-
SHA1
c9c509e384756b55167e19aa93f90ca49bf2c184
-
SHA256
57d8c94738921a61c25e9022cd77fb84641e31eca86c1ef8fb169a398c068614
-
SHA512
56ab28bd0415f4d20f2ae97648f487b0832db80f1e96b620aea07260af9ebd9512214b1a855ed385c5ecfdec198843fb6ebed9562c133ec146662562145c225c
-
SSDEEP
3072:cBpsSkwwfiSyt5RgFqB+Myx/CjxaRP0yw:cltwfiSiAqB+MD8a
Score1/10 -
-
-
Target
OrcusRAT-main/libraries/Orcus.Administration.Licensing.dll
-
Size
80KB
-
MD5
70e207da89961cd32217eabbe3ac0791
-
SHA1
305ba309e762a128ae098e5bf0241ba71f3a331e
-
SHA256
83f968c6682b0e52b217daa6aa3da21be6967aa194a14631f43cc76c11a142e9
-
SHA512
8d9de9a9b3ad265a1df7bd7ab790db639d6ef4b871275a5b2fbb72f9b324cc3158d2073de2de78692fa7ffe64e78e31e7d7f75cb3b50c0d6513da21094bad075
-
SSDEEP
1536:I+ILbMdO5V0tqQdHNWNEyieS9pJShPB+Viy6Sp6LRaKN/8:UVavdHNWNEyib9pJShPB+Viy6Sp6LRaN
Score1/10 -