MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 29193442b685f9f90be45ef20f4f1f4db139c36e46d161beeb6508687bec28cb. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


OrcusRAT


Vendor detections: 11


Intelligence 11 IOCs 1 YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 29193442b685f9f90be45ef20f4f1f4db139c36e46d161beeb6508687bec28cb
SHA3-384 hash: 35a6c6a871d66c6fee2a42347663f32585aca7424becb0315901218d3052ef753e1853f545dd461ade2298dba3e46a54
SHA1 hash: 275dda1da9cb843f9ace1eac4d457891e0e02c61
MD5 hash: ecabd9d17bc89b99f740730eb2386e23
humanhash: lake-fruit-july-nevada
File name:29193442b685f9f90be45ef20f4f1f4db139c36e46d161beeb6508687bec28cb
Download: download sample
Signature OrcusRAT
Create hunting rule
File size:965'120 bytes
First seen:2021-09-06 06:39:17 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'609 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 12288:rOlFLIwNYWIIrwAAlQvzog1q/QGcJFUvetc0nsfZXa6W6x9OuHL1Wb3G1igWNGFN:QFHw7c1XJ2W7nWVAw9OuHLcTLGrfq2
Threatray 77 similar samples on MalwareBazaar
TLSH T1B8252309F758D2B4C94D9277ED67D3F84B76CC85AC9202073682378F7C7B22A8A56583
dhash icon 0000004020000000 (4 x OrcusRAT)
Reporter JAMESWT_WT
Tags:exe OrcusRAT

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
199.195.253.181:50721 https://threatfox.abuse.ch/ioc/216745/

Intelligence

File Origin
# of uploads :
1
# of downloads :
866
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
29193442b685f9f90be45ef20f4f1f4db139c36e46d161beeb6508687bec28cb
Verdict:
Malicious activity
Analysis date:
2021-09-06 07:46:33 UTC
Tags:
rat orcus trojan
Link:
https://app.any.run/tasks/a4b25d57-161f-4799-9a1d-bca7b4686bad

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
OrcusRAT
Create hunting rule
Link:
https://www.capesandbox.com/analysis/185551/
Detection(s):
SecuriteInfo.com.AgentTesla-FDCVECABD9D17BC8.5820.19190.UNOFFICIAL
Create hunting rule

Result
Verdict:
Suspicious
Maliciousness:

Behaviour
Creating a window
Launching a process
Creating a process with a hidden window
Forced system process termination
Sending a UDP request
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/d4322af3-383a-405b-9094-9231edb83a77
Result
Threat name:
Orcus
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/845881
Signature
.NET source code contains potential unpacker
Antivirus detection for dropped file
Changes security center settings (notifications, updates, antivirus, firewall)
Connects to many ports of the same IP (likely port scanning)
Creates an undocumented autostart registry key
Deletes itself after installation
Drops executables to the windows directory (C:\Windows) and starts them
Injects a PE file into a foreign processes
Installs a global keyboard hook
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments
Uses powershell Test-Connection to delay payload execution;
Writes to foreign memory regions
Yara detected Costura Assembly Loader
Yara detected Orcus RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 478312 Sample: ax1n5PdVg4 Startdate: 06/09/2021 Architecture: WINDOWS Score: 100 75 Malicious sample detected (through community Yara rule) 2->75 77 Multi AV Scanner detection for dropped file 2->77 79 Multi AV Scanner detection for submitted file 2->79 81 7 other signatures 2->81 8 ax1n5PdVg4.exe 8 2->8         started        12 svchost.exe 2->12         started        14 svchost.exe 9 1 2->14         started        17 12 other processes 2->17 process3 dnsIp4 55 C:\Users\user\AppData\...\DllPatcher.exe, PE32 8->55 dropped 57 C:\Users\user\AppData\Local\Temp\RegAsm.exe, PE32 8->57 dropped 59 C:\Users\...\DllPatcher.exe:Zone.Identifier, ASCII 8->59 dropped 61 C:\Users\user\AppData\...\ax1n5PdVg4.exe.log, ASCII 8->61 dropped 89 Creates an undocumented autostart registry key 8->89 91 Writes to foreign memory regions 8->91 93 Uses powershell Test-Connection to delay payload execution; 8->93 95 Injects a PE file into a foreign processes 8->95 19 RegAsm.exe 8->19         started        24 powershell.exe 8->24         started        26 powershell.exe 5 8->26         started        30 9 other processes 8->30 97 Changes security center settings (notifications, updates, antivirus, firewall) 12->97 28 MpCmdRun.exe 12->28         started        67 127.0.0.1 unknown unknown 14->67 69 192.168.2.1 unknown unknown 17->69 file5 signatures6 process7 dnsIp8 63 199.195.253.181, 49722, 49727, 50721 PONYNETUS United States 19->63 65 185.175.56.98, 50721 HOSTHATCHUS Germany 19->65 51 C:\Windows\SysWOW64\WindowsInput.exe, PE32 19->51 dropped 53 C:\Windows\SysWOW64\WindowsInput.exe.config, XML 19->53 dropped 83 Drops executables to the windows directory (C:\Windows) and starts them 19->83 85 Installs a global keyboard hook 19->85 32 WindowsInput.exe 19->32         started        87 Deletes itself after installation 24->87 35 conhost.exe 24->35         started        37 conhost.exe 26->37         started        39 conhost.exe 28->39         started        41 conhost.exe 30->41         started        43 conhost.exe 30->43         started        45 conhost.exe 30->45         started        47 5 other processes 30->47 file9 signatures10 process11 signatures12 71 Antivirus detection for dropped file 32->71 73 Multi AV Scanner detection for dropped file 32->73 49 conhost.exe 37->49         started        process13
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/29193442b685f9f90be45ef20f4f1f4db139c36e46d161beeb6508687bec28cb/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2021-09-05 03:52:19 UTC
File Type:
PE (.Net Exe)
Extracted files:
31
AV detection:
17 of 43 (39.53%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=femtiqvwqx47sc7el3za6ty7jwyttq3oi3iwdpxlmuegq67mfdfq._file
Verdict:
malicious
Similar samples:
1a4284cd084b609aa03892894e379c630505b5e4b9ccfc278138d36668f4526f
OrcusRAT
28027fae1edf2324a8165c9f1a82273f958385c4947e8750a6bdcf29ec2e4906
OrcusRAT
3e40414d3d75b88373027c33bbe22e90a6ef7fdf7c98b8b6e8a8e51b4b781a56
OrcusRAT
50c1c541f9daea24b578ac94fd709b1214207a38cbc2ba3b36b2b0e81d0e4ee1
OrcusRAT
5fe03c646fcc7a7b912b2266fe54c645f203d22bfae171bf5f089e9934711dbb
OrcusRAT
85d9cae5e66a5a61a367bcd7b7967ed5715fab928604714db8050ccddab5d150
OrcusRAT
d7f7b600a0291f227e18c700916cbd7552aeb595e51a1ab918e164255cc29b1b
OrcusRAT
e7e7d51e82941b9eb56f82854e9682dc7a8593185ce6216082d5f795ceace582
OrcusRAT
+ 67 additional samples on MalwareBazaar
Result
Malware family:
orcus
Create hunting rule
Score:
  10/10
Tags:
family:orcus rat spyware stealer
Link:
https://tria.ge/reports/210906-he9vpsdfhk/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in System32 directory
Suspicious use of SetThreadContext
Deletes itself
Loads dropped DLL
Executes dropped EXE
Orcurs Rat Executable
Orcus
Unpacked files
SH256 hash:
4f25b0e154b55bdc7175a8572f0b8651b61a6a20e30dc65ec11303d45d66ea3c
MD5 hash:
2b8e787fd2894548e17e39911860e2d3
SHA1 hash:
15b86e4d0d0be12bb3fa71c8f1b3a359b823e956
Link:
https://www.unpac.me/results/69967259-e4a1-4db9-b7da-12a1dec76619/
SH256 hash:
a1019b8113751b6460257ae4371533c166058c7254106bb4cb4d4890209e4bbc
MD5 hash:
3c1a9aee450c343935a132b64d92ffb9
SHA1 hash:
d85dbf6b9fede1b52a07d1a2a84d4fdb12d05059
Link:
https://www.unpac.me/results/69967259-e4a1-4db9-b7da-12a1dec76619/
SH256 hash:
3a9df72fca6d9b421eba8a6f474d00883f0ec0beae33504a5998ef186a721056
MD5 hash:
5d7340d6ec669f9fc1c12a72cc00d373
SHA1 hash:
238c6d11feb7ab7c50897e2f2ebf1a06333cbc0c
Link:
https://www.unpac.me/results/69967259-e4a1-4db9-b7da-12a1dec76619/
SH256 hash:
29193442b685f9f90be45ef20f4f1f4db139c36e46d161beeb6508687bec28cb
MD5 hash:
ecabd9d17bc89b99f740730eb2386e23
SHA1 hash:
275dda1da9cb843f9ace1eac4d457891e0e02c61
Link:
https://www.unpac.me/results/69967259-e4a1-4db9-b7da-12a1dec76619/
Malware family:
OrcusRAT
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/29193442b685/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/29193442b685f9f90be45ef20f4f1f4db139c36e46d161beeb6508687bec28cb

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/185551/

Comments