MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 030de3a6ac5f11501e8a9492846e393fc8be584f4dd68355bc54a70bb35ac4a7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


OrcusRAT


Vendor detections: 10


Intelligence 10 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 030de3a6ac5f11501e8a9492846e393fc8be584f4dd68355bc54a70bb35ac4a7
SHA3-384 hash: b6effe1f5b2f36572051a9c6050f7fa8f675ccf9bec33d7a288652b96de8f34efbed8185cc1427521022d2216ff661be
SHA1 hash: 1a14af135927d66e3c5aeb694c6e4da28c1461b0
MD5 hash: 50051672183c94eb34de4953132badcb
humanhash: wolfram-low-connecticut-solar
File name:50051672183c94eb34de4953132badcb.exe
Download: download sample
Signature OrcusRAT
Create hunting rule
File size:92'880 bytes
First seen:2022-01-08 16:04:30 UTC
Last seen:2022-01-08 17:42:24 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'660 x AgentTesla, 19'470 x Formbook, 12'208 x SnakeKeylogger)
ssdeep 1536:r1peOOgU9OtuOsECrEerq1o1Gnvlyr+CwaMYONe+b3SFu1AFNGaX9cfo:v1OgU9FQqcoQntK+C7VieM3SFZNt9cfo
Threatray 182 similar samples on MalwareBazaar
TLSH T13F93CFA56B9944CBC4D39976D89FC146CB70AF061101C67BB136BB84BF1B3E72748A0A
File icon (PE):PE icon
dhash icon 182b4d5d84f0f0b2 (9 x Formbook, 8 x AgentTesla, 6 x RemcosRAT)
Reporter abuse_ch
Tags:exe OrcusRAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
815
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
50051672183c94eb34de4953132badcb.exe
Verdict:
Malicious activity
Analysis date:
2022-01-08 16:08:36 UTC
Tags:
rat orcus
Link:
https://app.any.run/tasks/e9da46cf-6998-4d2c-8cd9-d2317e1eb97a

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/217838/
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.47844412.3640.9045.UNOFFICIAL
Create hunting rule

Result
Verdict:
Clean
Maliciousness:

Behaviour
Searching for the window
Сreating synchronization primitives
Launching a process
Creating a process with a hidden window
DNS request
Sending an HTTP GET request
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
obfuscated overlay packed replace.exe
Link:
https://www.filescan.io/uploads/61d9b63402e388f9fdb6c9ab/reports/6c193d35-622b-4081-958a-0c5fe06ea102/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Quasar RAT
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/c56f632e-7736-4384-8b1e-fd06b6ef06a9
Result
Threat name:
Unknown
Detection:
malicious
Classification:
evad
Score:
60 / 100
Link:
https://www.joesandbox.com/analysis/917159
Signature
Encrypted powershell cmdline option found
Machine Learning detection for sample
Multi AV Scanner detection for submitted file
Sigma detected: Suspicious Encoded PowerShell Command Line
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 549637 Sample: qyWUEnDleC.exe Startdate: 08/01/2022 Architecture: WINDOWS Score: 60 33 cdn.discordapp.com 2->33 35 Multi AV Scanner detection for submitted file 2->35 37 Machine Learning detection for sample 2->37 39 Sigma detected: Suspicious Encoded PowerShell Command Line 2->39 8 qyWUEnDleC.exe 3 2->8         started        signatures3 process4 signatures5 41 Encrypted powershell cmdline option found 8->41 11 powershell.exe 16 8->11         started        13 powershell.exe 16 8->13         started        15 powershell.exe 14 8->15         started        17 5 other processes 8->17 process6 process7 19 conhost.exe 11->19         started        21 conhost.exe 13->21         started        23 conhost.exe 15->23         started        25 conhost.exe 17->25         started        27 conhost.exe 17->27         started        29 conhost.exe 17->29         started        31 2 other processes 17->31
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/030de3a6ac5f11501e8a9492846e393fc8be584f4dd68355bc54a70bb35ac4a7/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-01-08 16:05:12 UTC
File Type:
PE (.Net Exe)
Extracted files:
9
AV detection:
17 of 28 (60.71%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
18955e0d050b9ce796bd444e130c12b4428b304b0d4eb16b54f77657d8ec0379
OrcusRAT
3573aef05e6255e2579fc47d55765871702a351b9d7362a9d855ee92ed28aadb
OrcusRAT
3c245e6f199b0d579015fc5bc4322710133ef58d61f3df034d862085aecb3a14
OrcusRAT
5066020c9801057b9e6e6e5ced5ef8d35854cb58118e4aae55d7d3b532ebcecd
OrcusRAT
50c1c541f9daea24b578ac94fd709b1214207a38cbc2ba3b36b2b0e81d0e4ee1
OrcusRAT
c660a1270e4617197004bb01cf785ddcbf5c17875864aaeaab7660e78ba7eb01
OrcusRAT
e0e20159839ff7fa71278a67d90b7fa685733d19c3eb36de406669e6c070c60e
OrcusRAT
e21d43df96e42ae29354ecf4b21e803c0c3bfd9a706f5f7ee334b1893ae92c6a
OrcusRAT
f635354e86b28a65eb77122574493cfe2e37efeca2d3df316a4880db6e3786b9
OrcusRAT
f89110f497e2a39c3fc34329b16e5528564bae652fda61cd07410b27e046fdf3
OrcusRAT
+ 172 additional samples on MalwareBazaar
Result
Malware family:
orcus
Create hunting rule
Score:
  10/10
Tags:
family:orcus persistence rat spyware stealer upx
Link:
https://tria.ge/reports/220108-tjhskadbc6/
Behaviour
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Program Files directory
Drops file in System32 directory
Suspicious use of SetThreadContext
Loads dropped DLL
Reads user/profile data of web browsers
Executes dropped EXE
UPX packed file
Orcurs Rat Executable
Modifies WinLogon for persistence
Orcus
Malware Config
C2 Extraction:
omnicrie.ddns.net:10134
Unpacked files
SH256 hash:
030de3a6ac5f11501e8a9492846e393fc8be584f4dd68355bc54a70bb35ac4a7
MD5 hash:
50051672183c94eb34de4953132badcb
SHA1 hash:
1a14af135927d66e3c5aeb694c6e4da28c1461b0
Link:
https://www.unpac.me/results/c65d351a-40b7-432e-b37f-d4cb141b416c/
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/030de3a6ac5f/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.60
Link:
https://yomi.yoroi.company/submissions/030de3a6ac5f11501e8a9492846e393fc8be584f4dd68355bc54a70bb35ac4a7

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_SUSPICIOUS_EXE_DiscordURL
Create hunting rule
Author:ditekSHen
Description:Detects executables Discord URL observed in first stage droppers
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash
Rule name:SUSP_PE_Discord_Attachment_Oct21_1
Create hunting rule
Author:Florian Roth
Description:Detects suspicious executable with reference to a Discord attachment (often used for malware hosting on a legitimate FQDN)
Reference:Internal Research

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

OrcusRAT

Executable exe 030de3a6ac5f11501e8a9492846e393fc8be584f4dd68355bc54a70bb35ac4a7

(this sample)

Cape
Cape
https://www.capesandbox.com/analysis/217838/
  
URLhaus
https://urlhaus.abuse.ch/url/1955872/
  
Delivery method
Distributed via web download

Comments