Overview

overview

10

Static

static

10

OrcusRAT-m...re.dll

windows7-x64

1

OrcusRAT-m...re.dll

windows10-2004-x64

1

OrcusRAT-m...as.dll

windows7-x64

1

OrcusRAT-m...as.dll

windows10-2004-x64

1

OrcusRAT-m...le.dll

windows7-x64

1

OrcusRAT-m...le.dll

windows10-2004-x64

1

OrcusRAT-m...pf.dll

windows7-x64

1

OrcusRAT-m...pf.dll

windows10-2004-x64

1

OrcusRAT-m...er.dll

windows7-x64

1

OrcusRAT-m...er.dll

windows10-2004-x64

1

OrcusRAT-m...op.dll

windows7-x64

1

OrcusRAT-m...op.dll

windows10-2004-x64

1

OrcusRAT-m...it.dll

windows7-x64

1

OrcusRAT-m...it.dll

windows10-2004-x64

1

OrcusRAT-m...ro.dll

windows7-x64

1

OrcusRAT-m...ro.dll

windows10-2004-x64

1

OrcusRAT-m...ks.dll

windows7-x64

1

OrcusRAT-m...ks.dll

windows10-2004-x64

1

OrcusRAT-m...il.dll

windows7-x64

1

OrcusRAT-m...il.dll

windows10-2004-x64

1

OrcusRAT-m...og.dll

windows7-x64

1

OrcusRAT-m...og.dll

windows10-2004-x64

1

OrcusRAT-m...on.dll

windows7-x64

1

OrcusRAT-m...on.dll

windows10-2004-x64

1

OrcusRAT-m...pf.dll

windows7-x64

1

OrcusRAT-m...pf.dll

windows10-2004-x64

1

OrcusRAT-m...ds.dll

windows7-x64

1

OrcusRAT-m...ds.dll

windows10-2004-x64

1

OrcusRAT-m...ng.dll

windows7-x64

1

OrcusRAT-m...ng.dll

windows10-2004-x64

1

OrcusRAT-m...ng.dll

windows7-x64

1

OrcusRAT-m...ng.dll

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    OrcusRAT-main.zip

  • Size

    25.0MB

  • Sample

    241101-td9zvstpam

  • MD5

    4ebe8621171038676189cbc5e7053d9f

  • SHA1

    2e3a3b97163d1e8af1e41c36f9495062fb4b1934

  • SHA256

    3786d314f4e3906400b24657ed15fca047576eba9cf17630246db69503fdbea3

  • SHA512

    e0091ae9f3acddc7e8d11b89a60debc3dab57b8af57bde4a3f538b2283eae398a1adec8224bf5fd2d0be61be015fc2a79c49b06cf786945073e1cc87d66be356

  • SSDEEP

    786432:DFrAoo07VJxiSdlBx4IVwXuOHKW3kijZk:hrA+xJBgIEuMUiNk

Score
10/10
orcus

Malware Config

Targets

    • Target

      OrcusRAT-main/libraries/CSCore.dll

    • Size

      496KB

    • MD5

      5e8fe2a84d3076f5d9815b77eb67d4f6

    • SHA1

      c08f0f706520e1a32b0999bda032c90755f7d374

    • SHA256

      fd3feefc62097ff785c7fdd524070e25fcaba7e4ce19f5480ecad695dd2a5405

    • SHA512

      8a5e77aa6f31db39dae45dbb2dc45da717a065f6831552b0133f6defe6551e236226acfc5dfecc93dad1a3457720d8f85a985c71a7591d45755c3f8ff4740438

    • SSDEEP

      6144:qgnuf8G18h9LKXYTD+XVyX6QgYC/f98+5JBO5blpIz0oG2th9i/J:qgFBKcDFXDgYC/f987Kz19i/

    Score
    1/10
    behavioral1behavioral2

    • Target

      OrcusRAT-main/libraries/Exceptionless.Extras.dll

    • Size

      71KB

    • MD5

      d3fcd5038079ef42e23ed39a86af5a31

    • SHA1

      3977309df5b3ddc0218a800ee463ddcbcae7503e

    • SHA256

      9d4ab0418d94d3c3d7025ecc1c70ce1762ee12aaa4d35666c2dc7887df53a537

    • SHA512

      8535e4b5b7b61cf31fe69bd43eb2ba4c2a248a2f2a6efcf9b1ffc9cf4d39b67dcb687d45964054b3900f5aa21662b4acc91302f02e99e819ac6f5827a0d493d0

    • SSDEEP

      1536:mB4/RmrDkeXDlc4n10Yf6vvB78MFG20es2A1OLv2Nvr838HVHHOU30fKFWHVyePD:m+/IXZTn1BjpemrPEXK7eASoC

    Score
    1/10
    behavioral3behavioral4

    • Target

      OrcusRAT-main/libraries/Exceptionless.Portable.dll

    • Size

      678KB

    • MD5

      6aba9f00d64371b940eedc21804ea9eb

    • SHA1

      5fb0e520a23c780474b0866218c61ff55d083b3f

    • SHA256

      22c949720dacd2dc19b7744185b18faf53dc18199c36af44158257a08ce7f3fd

    • SHA512

      9166ff3cfd7adc334f3a98f4a40736c178a1c793f6ca264722bd1b962a3d059d88035eee1f45aab2b45a8692a13ef50c8e762c4c8600937b263fd7c2703185c0

    • SSDEEP

      12288:js84bq85JQrVPvIxDlm1X4Qz9g35VF7Syj4pYoSpc9UM04uBrAaJZSPZZBrEK8eV:Y4rVImlzqVFWyj4pYoSpc9UM04uBrAa6

    Score
    1/10
    behavioral5behavioral6

    • Target

      OrcusRAT-main/libraries/Exceptionless.Wpf.dll

    • Size

      26KB

    • MD5

      609fbfcf1bea7ac58712764cb9e408f1

    • SHA1

      6831a6338e056540c5305b192b726ea68413f6c2

    • SHA256

      c14b8c33f9679cf4cf4f80d91698e3f40acdbd82d3b700a8b2813322e5e42ec3

    • SHA512

      41bc3949421b2179e6208f3677264399f60f81bca69a9cf632e8e8ca4978710885674d76fa635b133b6638cad11813a33a538cbccde7cf482b7e61719e8ceaac

    • SSDEEP

      384:SO6qmMxrZfvTOtDTjzImcOFz/Ym1T9yQT0B0Am9Z6budtzYi8LkbXgAZyTlaiA1W:8qfOtDbcsz/9NV66HYikQiLEnC

    Score
    1/10
    behavioral7behavioral8

    • Target

      OrcusRAT-main/libraries/FluentCommandLineParser.dll

    • Size

      43KB

    • MD5

      9b5e37f89268ccce0e098222004093ad

    • SHA1

      30b12174abda6a420b2cc152b5c682ff8f106c37

    • SHA256

      fe068b6f15a5423f86558927dd22ec35070c041db9cde1ecade0590d93ca5285

    • SHA512

      23e8cbaa6103f5a76729ee8470b5b208d67be22c9b9fa78340055ac8ded04dc6147c8c50cde96f7c10b111f81cab3e5504227ac5b8f1a616c1a1384c6350257f

    • SSDEEP

      768:U74t6uOtRT8HuJ071hEdOgaaGoCbvfkGujm:Gc6uOtRa/71UO1onLS

    Score
    1/10
    behavioral10behavioral9

    • Target

      OrcusRAT-main/libraries/GongSolutions.Wpf.DragDrop.dll

    • Size

      53KB

    • MD5

      dcb1b714646f72939969441ee16e3197

    • SHA1

      294014a44415bfb8a0415e1c19c7e8763046ffc8

    • SHA256

      7236cd133dc18064cd57028be5cca18708117c3082f5ca001cb69eaf596a578c

    • SHA512

      2e2b6fa0918a59915165ed689f524576e94cb4f531c4eac58a74049a187bfdc6d87423150e26dd244bb9b4988b4017afc0b62865f5f686524f60e7512e35679c

    • SSDEEP

      1536:nvzBUJUgtSMoY0Z9D24W5d7Oi8SXMocAdg17wr:nv0fkDngOi7cocAdnr

    Score
    1/10
    behavioral11behavioral12

    • Target

      OrcusRAT-main/libraries/ICSharpCode.AvalonEdit.dll

    • Size

      592KB

    • MD5

      d7467d0156f22feb4b22cc5f74d7bd60

    • SHA1

      bcc1d959786ba4253491b67d448f97cf5ad709ed

    • SHA256

      2bf6079c143f177d954731db2ffde515bee8fbd6261e0d338ba8e7c8df1ab658

    • SHA512

      f13092a4154524226900c8f3089ef776932cae601cb21cc10af1111014aef97a1183a2344da3f5b8f5b9fbe8b4b420412d79b71e97a1b4ed2ec384b502ba1c28

    • SSDEEP

      6144:64Gybj4PJqJZD0JOi0Av5+ENJzHLeDjN3kNHjoJAo7gOfwlflvuSn:6i4PwJZ1szeDjKRWwl5

    Score
    1/10
    behavioral13behavioral14

    • Target

      OrcusRAT-main/libraries/MahApps.Metro.dll

    • Size

      918KB

    • MD5

      fb1e8eee84791cc015e043ab0ce32bba

    • SHA1

      42fb789011213635a7d022ba4fd5461a0d9a134d

    • SHA256

      0de72da4bc2d16d39c30368af880d754fa0bd9745897652ba50213e589d265c5

    • SHA512

      748af415c875cd5d44f305cf58060e7e66ef2ef041b6e86e3a76287a51af63116096eaed0877dc48c17da6594ad0c8dbf0ecadecb763dd469be8b6cc1d02d4a0

    • SSDEEP

      12288:qADBZgu6aCRVudOz7A+H/uzylD/AcnnnnnnnnnnnnnnnnnnnnnnnGnknnnnnAMxg:qYMRMOzjuuF/AmHRNXmbJtV/

    Score
    1/10
    behavioral15behavioral16

    • Target

      OrcusRAT-main/libraries/Microsoft.Threading.Tasks.dll

    • Size

      36KB

    • MD5

      d01819bfe03222dfa9e35a36555b6b6c

    • SHA1

      25f8069590b14724f28e6a04b8a42e4ef4a8562d

    • SHA256

      5f29e16edff5379e93d5be9bee4cddf98132b84326027688511ac0f3157aaf94

    • SHA512

      e63901f39315972e446768f2c14b4279cf1dd382f97ac90c444c4d858c2a486736a259c47245026b11e5c0846310e7da020bf2466ea91aa0a15d22cb67b37477

    • SSDEEP

      384:AjCan21RTf1FuPIgbSVHfiWvoVZHL+8SChE+QNEv4USWyWcWZ1q//0GftpBjfuHk:A+e21RTrgbSpfihdvF4eg8iUHWTmlr+

    Score
    1/10
    behavioral17behavioral18

    • Target

      OrcusRAT-main/libraries/Mono.Cecil.dll

    • Size

      274KB

    • MD5

      6d6292bc8e698e53e69556add6f62442

    • SHA1

      fab26eb07adab421797689da27ad754aa1c31810

    • SHA256

      0f6465ce57a0cbabc37013c8e3c9f110672de1c127b6192177d59eb1c7809772

    • SHA512

      f77c995857bf3c62bd87cce4246d9792d388af33664fbabf05bfcf574ae9332c45013697be7f698bff6cd33b02573abcbeae172b53c75979339e01123c61ae32

    • SSDEEP

      6144:BaUU67x2AE6gaSTYUs8Nr/gaGGv8+iGKdJDkP0bAZ:biG8Nr/vv8+O

    Score
    1/10
    behavioral19behavioral20

    • Target

      OrcusRAT-main/libraries/NLog.dll

    • Size

      517KB

    • MD5

      27c2b96dfbebba578638588d2c95705f

    • SHA1

      6223920526982da59a93ccb2d733e9bdbb1afbaf

    • SHA256

      a74414ee5a23d73d879c216d9cfd96a9a8ad048773fe689d8a8b3022c9869cdf

    • SHA512

      aa90ef4fef936a43c3413c90427668b7956742bb88eb2693d8dc23654952997771e702f5c0b8ffa04e8f0ef8e16809d8bb3ac1f007bc9989b039e78a1d2a6358

    • SSDEEP

      12288:PNShT6DUsQfOrYqk1CXQdcGASuocRwsCbDRHDh:cNEUsQfOrYqk1CXQdcGASuocRwsCbDRl

    Score
    1/10
    behavioral21behavioral22

    • Target

      OrcusRAT-main/libraries/Newtonsoft.Json.dll

    • Size

      510KB

    • MD5

      c3c04754418382f505cafc18d64427f5

    • SHA1

      cac5e36dc498d6bb16170020be021ff5bd18a9e2

    • SHA256

      df8ec2e0245829ddec5b79f1918c3ae3a3fa540a5a0e3c410e2b6ef0bebc7927

    • SHA512

      bda5efd0f69a9c7198841e5d31744fa2bebb05cedb1e2846a0d2dbce6c3193da69c181be1116f38cd5f3d61b441567b1da2c844522184323e3d429294aa91ab5

    • SSDEEP

      6144:D5AGNDJNY1d2Skc39wf9IsDraDmh7JKH8Vjp4baBmBFSu4oNVg2OUvie:LNYNY9LaDKKGSBTV9

    Score
    1/10
    behavioral23behavioral24

    • Target

      OrcusRAT-main/libraries/Ookii.Dialogs.Wpf.dll

    • Size

      105KB

    • MD5

      5926472580c7a7b45cd611dc0fb06244

    • SHA1

      a3b33bc8c9963f727bc2a2714ec6de0c607bca40

    • SHA256

      04b8cb55ff481a4f4f9a60bc3c5e06ed78c12a8677c211621edcf9d8467bd823

    • SHA512

      be05b4695896b4a2ad2ca63836c9d05084b8aa1b71929e1b081fd47b851282438bdf8c7bc65466ce7f3fe30335e743c0bd12aa52670b12d6eaec8b3bfd193056

    • SSDEEP

      1536:5lPwQgrQnQaIM9MsmdgdSrtP7QdniuLF+mnNuu48pMBqDALYHu+an+HeaP6kOdWF:5lNJIceEMGFHnM8A8HC++aPA3O

    Score
    1/10
    behavioral25behavioral26

    • Target

      OrcusRAT-main/libraries/Orcus.Administration.Commands.dll

    • Size

      106KB

    • MD5

      bca25796ab6eaced997fe584d561ab78

    • SHA1

      c9c509e384756b55167e19aa93f90ca49bf2c184

    • SHA256

      57d8c94738921a61c25e9022cd77fb84641e31eca86c1ef8fb169a398c068614

    • SHA512

      56ab28bd0415f4d20f2ae97648f487b0832db80f1e96b620aea07260af9ebd9512214b1a855ed385c5ecfdec198843fb6ebed9562c133ec146662562145c225c

    • SSDEEP

      3072:cBpsSkwwfiSyt5RgFqB+Myx/CjxaRP0yw:cltwfiSiAqB+MD8a

    Score
    1/10
    behavioral27behavioral28

    • Target

      OrcusRAT-main/libraries/Orcus.Administration.Licensing.dll

    • Size

      80KB

    • MD5

      70e207da89961cd32217eabbe3ac0791

    • SHA1

      305ba309e762a128ae098e5bf0241ba71f3a331e

    • SHA256

      83f968c6682b0e52b217daa6aa3da21be6967aa194a14631f43cc76c11a142e9

    • SHA512

      8d9de9a9b3ad265a1df7bd7ab790db639d6ef4b871275a5b2fbb72f9b324cc3158d2073de2de78692fa7ffe64e78e31e7d7f75cb3b50c0d6513da21094bad075

    • SSDEEP

      1536:I+ILbMdO5V0tqQdHNWNEyieS9pJShPB+Viy6Sp6LRaKN/8:UVavdHNWNEyib9pJShPB+Viy6Sp6LRaN

    Score
    1/10
    behavioral29behavioral30

    • Target

      OrcusRAT-main/libraries/Orcus.Administration.Licensing.pdb

    • Size

      80KB

    • MD5

      70e207da89961cd32217eabbe3ac0791

    • SHA1

      305ba309e762a128ae098e5bf0241ba71f3a331e

    • SHA256

      83f968c6682b0e52b217daa6aa3da21be6967aa194a14631f43cc76c11a142e9

    • SHA512

      8d9de9a9b3ad265a1df7bd7ab790db639d6ef4b871275a5b2fbb72f9b324cc3158d2073de2de78692fa7ffe64e78e31e7d7f75cb3b50c0d6513da21094bad075

    • SSDEEP

      1536:I+ILbMdO5V0tqQdHNWNEyieS9pJShPB+Viy6Sp6LRaKN/8:UVavdHNWNEyib9pJShPB+Viy6Sp6LRaN

    Score
    1/10
    behavioral31behavioral32

MITRE ATT&CK Matrix

Tasks