Overview
overview
10Static
static
10OrcusRAT-m...al.url
windows10-ltsc 2021-x64
1OrcusRAT-m...at.url
windows10-ltsc 2021-x64
1OrcusRAT-m...on.exe
windows10-ltsc 2021-x64
10OrcusRAT-m...ll.exe
windows10-ltsc 2021-x64
7OrcusRAT-m...on.dll
windows10-ltsc 2021-x64
1OrcusRAT-m...ox.dll
windows10-ltsc 2021-x64
1OrcusRAT-m...re.dll
windows10-ltsc 2021-x64
1OrcusRAT-m...as.dll
windows10-ltsc 2021-x64
1OrcusRAT-m...le.dll
windows10-ltsc 2021-x64
1OrcusRAT-m...pf.dll
windows10-ltsc 2021-x64
1OrcusRAT-m...er.dll
windows10-ltsc 2021-x64
1OrcusRAT-m...op.dll
windows10-ltsc 2021-x64
1OrcusRAT-m...it.dll
windows10-ltsc 2021-x64
1OrcusRAT-m...ro.dll
windows10-ltsc 2021-x64
1OrcusRAT-m...ks.dll
windows10-ltsc 2021-x64
1OrcusRAT-m...il.dll
windows10-ltsc 2021-x64
1OrcusRAT-m...og.dll
windows10-ltsc 2021-x64
1OrcusRAT-m...on.dll
windows10-ltsc 2021-x64
1OrcusRAT-m...pf.dll
windows10-ltsc 2021-x64
1OrcusRAT-m...ds.dll
windows10-ltsc 2021-x64
1OrcusRAT-m...ng.dll
windows10-ltsc 2021-x64
1OrcusRAT-m...ng.dll
windows10-ltsc 2021-x64
1OrcusRAT-m...ns.dll
windows10-ltsc 2021-x64
1OrcusRAT-m...ds.dll
windows10-ltsc 2021-x64
1OrcusRAT-m...ns.dll
windows10-ltsc 2021-x64
1OrcusRAT-m...es.dll
windows10-ltsc 2021-x64
1OrcusRAT-m...ed.dll
windows10-ltsc 2021-x64
1OrcusRAT-m...pf.dll
windows10-ltsc 2021-x64
1OrcusRAT-m...ps.dll
windows10-ltsc 2021-x64
1OrcusRAT-m...ot.dll
windows10-ltsc 2021-x64
1OrcusRAT-m...it.dll
windows10-ltsc 2021-x64
1OrcusRAT-m...er.exe
windows10-ltsc 2021-x64
7Analysis
-
max time kernel
123s -
max time network
145s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241211-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
28-12-2024 18:38
Behavioral task
behavioral1
Sample
OrcusRAT-main/How To Open Port All Tutorial.url
Resource
win10ltsc2021-20241211-en
Behavioral task
behavioral2
Sample
OrcusRAT-main/How To Setup a Rat.url
Resource
win10ltsc2021-20241211-en
Behavioral task
behavioral3
Sample
OrcusRAT-main/Orcus.Administration.exe
Resource
win10ltsc2021-20241211-en
Behavioral task
behavioral4
Sample
OrcusRAT-main/Uninstall.exe
Resource
win10ltsc2021-20241211-en
Behavioral task
behavioral5
Sample
OrcusRAT-main/libraries/AlphaChiTech.Virtualization.dll
Resource
win10ltsc2021-20241211-en
Behavioral task
behavioral6
Sample
OrcusRAT-main/libraries/Be.Windows.Forms.HexBox.dll
Resource
win10ltsc2021-20241211-en
Behavioral task
behavioral7
Sample
OrcusRAT-main/libraries/CSCore.dll
Resource
win10ltsc2021-20241211-en
Behavioral task
behavioral8
Sample
OrcusRAT-main/libraries/Exceptionless.Extras.dll
Resource
win10ltsc2021-20241211-en
Behavioral task
behavioral9
Sample
OrcusRAT-main/libraries/Exceptionless.Portable.dll
Resource
win10ltsc2021-20241211-en
Behavioral task
behavioral10
Sample
OrcusRAT-main/libraries/Exceptionless.Wpf.dll
Resource
win10ltsc2021-20241211-en
Behavioral task
behavioral11
Sample
OrcusRAT-main/libraries/FluentCommandLineParser.dll
Resource
win10ltsc2021-20241211-en
Behavioral task
behavioral12
Sample
OrcusRAT-main/libraries/GongSolutions.Wpf.DragDrop.dll
Resource
win10ltsc2021-20241211-en
Behavioral task
behavioral13
Sample
OrcusRAT-main/libraries/ICSharpCode.AvalonEdit.dll
Resource
win10ltsc2021-20241023-en
Behavioral task
behavioral14
Sample
OrcusRAT-main/libraries/MahApps.Metro.dll
Resource
win10ltsc2021-20241211-en
Behavioral task
behavioral15
Sample
OrcusRAT-main/libraries/Microsoft.Threading.Tasks.dll
Resource
win10ltsc2021-20241211-en
Behavioral task
behavioral16
Sample
OrcusRAT-main/libraries/Mono.Cecil.dll
Resource
win10ltsc2021-20241211-en
Behavioral task
behavioral17
Sample
OrcusRAT-main/libraries/NLog.dll
Resource
win10ltsc2021-20241211-en
Behavioral task
behavioral18
Sample
OrcusRAT-main/libraries/Newtonsoft.Json.dll
Resource
win10ltsc2021-20241211-en
Behavioral task
behavioral19
Sample
OrcusRAT-main/libraries/Ookii.Dialogs.Wpf.dll
Resource
win10ltsc2021-20241211-en
Behavioral task
behavioral20
Sample
OrcusRAT-main/libraries/Orcus.Administration.Commands.dll
Resource
win10ltsc2021-20241211-en
Behavioral task
behavioral21
Sample
OrcusRAT-main/libraries/Orcus.Administration.Licensing.dll
Resource
win10ltsc2021-20241211-en
Behavioral task
behavioral22
Sample
OrcusRAT-main/libraries/Orcus.Administration.Licensing.dll
Resource
win10ltsc2021-20241211-en
Behavioral task
behavioral23
Sample
OrcusRAT-main/libraries/Orcus.Administration.Plugins.dll
Resource
win10ltsc2021-20241211-en
Behavioral task
behavioral24
Sample
OrcusRAT-main/libraries/Orcus.Administration.StaticCommands.dll
Resource
win10ltsc2021-20241211-en
Behavioral task
behavioral25
Sample
OrcusRAT-main/libraries/Orcus.Plugins.dll
Resource
win10ltsc2021-20241211-en
Behavioral task
behavioral26
Sample
OrcusRAT-main/libraries/Orcus.Shared.Utilities.dll
Resource
win10ltsc2021-20241211-en
Behavioral task
behavioral27
Sample
OrcusRAT-main/libraries/Orcus.Shared.dll
Resource
win10ltsc2021-20241211-en
Behavioral task
behavioral28
Sample
OrcusRAT-main/libraries/OxyPlot.Wpf.dll
Resource
win10ltsc2021-20241211-en
Behavioral task
behavioral29
Sample
OrcusRAT-main/libraries/OxyPlot.Xps.dll
Resource
win10ltsc2021-20241211-en
Behavioral task
behavioral30
Sample
OrcusRAT-main/libraries/OxyPlot.dll
Resource
win10ltsc2021-20241211-en
Behavioral task
behavioral31
Sample
OrcusRAT-main/libraries/Sorzus.Wpf.Toolkit.dll
Resource
win10ltsc2021-20241211-en
Behavioral task
behavioral32
Sample
OrcusRAT-main/server/Orcus.Server.exe
Resource
win10ltsc2021-20241023-en
General
-
Target
OrcusRAT-main/How To Setup a Rat.url
-
Size
96B
-
MD5
8d61646db59cc7460b40bc79001a40a1
-
SHA1
e43cdfb3d27a0cb4b4532053c27810abf06d415e
-
SHA256
c5d1bc7427609e082195ad8db57c9b35b274e3df63a92d78917334425730d1e7
-
SHA512
9eef7dcaa96a52d52caff6b9709f8377437ff201e976761eec8c35669f946ef111d7da9528c8f253f469969513e4ec5e6a5d0b861665254a6564f8c2d85d9f99
Malware Config
Signatures
Processes
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL "C:\Users\Admin\AppData\Local\Temp\OrcusRAT-main\How To Setup a Rat.url"1⤵PID:3596
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations=is-enterprise-managed=no --field-trial-handle=4204,i,4538255413480930743,12957764444767653848,262144 --variations-seed-version --mojo-platform-channel-handle=4112 /prefetch:81⤵PID:1428
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --string-annotations=is-enterprise-managed=no --field-trial-handle=3264,i,4538255413480930743,12957764444767653848,262144 --variations-seed-version --mojo-platform-channel-handle=4208 /prefetch:81⤵PID:3532