MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 3e4ef7b0224b4601e28838ec6319634315025d824c1404a2a9e114139dbdbe21. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

OrcusRAT

Vendor detections: 10

Intelligence 10 IOCs 1 YARA 7 File information Comments 1

SHA256 hash:	3e4ef7b0224b4601e28838ec6319634315025d824c1404a2a9e114139dbdbe21
SHA3-384 hash:	26b43d7685bc92ec81e8822c57a23c988e0bcbb8b1127ac59055d42ec0733f9beea2e642054ca5d1f5eed3bd1e552659
SHA1 hash:	0caaca5d0f02fe988b7c6629271dfb325431b71c
MD5 hash:	cd42f90ac522a1bf3a23764c700bbfa4
humanhash:	bluebird-two-early-virginia
File name:	cd42f90ac522a1bf3a23764c700bbfa4.exe
Download:	download sample
Signature	OrcusRAT Create hunting rule
File size:	925'184 bytes
First seen:	2021-05-02 10:55:10 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'647 x AgentTesla, 19'451 x Formbook, 12'201 x SnakeKeylogger)
ssdeep	12288:08shHAVBuQBBed37dG1lFlWcYT70pxnnaaoawMRVcTqSA+9rZNrI0AilFEvxHvBI:N3s4MROxnF9LqrZlI0AilFEvxHiJAo
Threatray	46 similar samples on MalwareBazaar
TLSH	C215BF013FADBD07C1BE2678B6731AC90B78ED066092FB4E085851AD1DAFB01BD553A7
Reporter	abuse_ch
Tags:	exe OrcusRAT

abuse_ch

OrcusRAT C2:
185.163.47.163:10134

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
185.163.47.163:10134	https://threatfox.abuse.ch/ioc/28033/

Intelligence

File Origin

# of uploads :

# of downloads :

1'217

Origin country :

n/a

Vendor Threat Intelligence

Detection:

OrcusRAT

Link:

https://www.capesandbox.com/analysis/147898/

Detection(s):

Win.Packed.Passwordstealera-9803747-0

Win.Packed.Generic-9805849-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %temp% directory

Launching a process

Creating a process with a hidden window

Deleting a recently created file

Creating a file in the Program Files subdirectories

Creating a process from a recently created file

Creating a file

Setting a keyboard event handler

Creating a window

Sending a custom TCP request

Using the Windows Management Instrumentation requests

Sending a UDP request

Unauthorized injection to a recently created process

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

Orcus

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/706418

Signature

.NET source code contains potential unpacker

.NET source code contains very large strings

.NET source code references suspicious native API functions

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Contains functionality to disable the Task Manager (.Net Source)

Installs a global keyboard hook

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Dot net compiler compiles file from suspicious location

Yara detected Costura Assembly Loader

Yara detected Orcus RAT

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/3e4ef7b0224b4601e28838ec6319634315025d824c1404a2a9e114139dbdbe21/

Threat name:

ByteCode-MSIL.Trojan.Orcusrat

Status:

Malicious

First seen:

2021-05-02 10:41:21 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

25 of 29 (86.21%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=hzhppmbcjndadyuihdwgggldimkqexmcjqkajivj4ekbhhn5xyqq._file

Verdict:

malicious

Result

Malware family:

orcus

Score:

10/10

Tags:

family:orcus persistence rat spyware stealer

Link:

https://tria.ge/reports/210502-nqza31eqke/

Behaviour

Suspicious use of AdjustPrivilegeToken

Suspicious use of FindShellTrayWindow

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Drops file in Program Files directory

Drops file in Windows directory

Adds Run key to start application

Drops desktop.ini file(s)

Executes dropped EXE

Orcus

Orcus Main Payload

Unpacked files

SH256 hash:

3e4ef7b0224b4601e28838ec6319634315025d824c1404a2a9e114139dbdbe21

MD5 hash:

cd42f90ac522a1bf3a23764c700bbfa4

SHA1 hash:

0caaca5d0f02fe988b7c6629271dfb325431b71c

Link:

https://www.unpac.me/results/dd648951-dffa-48e5-bc4b-d8c9414af4f1/

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

qbot

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/3e4ef7b0224b4601e28838ec6319634315025d824c1404a2a9e114139dbdbe21

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Agenttesla_type2 Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Agenttesla in memory
Reference:	internal research

Rule name:	CAP_HookExKeylogger Create hunting rule
Author:	Brian C. Bell -- @biebsmalwareguy
Reference:	https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar

Rule name:	Chrome_stealer_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Chrome in files like avemaria

Rule name:	INDICATOR_SUSPICIOUS_GENInfoStealer Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing common artifcats observed in infostealers

Rule name:	Keylog_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Contains Keylog

Rule name:	MAL_BackNet_Nov18_1 Create hunting rule
Author:	Florian Roth
Description:	Detects BackNet samples
Reference:	https://github.com/valsov/BackNet

Rule name:	Select_from_enumeration Create hunting rule
Author:	James_inthe_box
Description:	IP and port combo

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

OrcusRAT

exe 3e4ef7b0224b4601e28838ec6319634315025d824c1404a2a9e114139dbdbe21

(this sample)

URLhaus

https://urlhaus.abuse.ch/url/646622/

Delivery method

Distributed via web download

URLhaus

https://urlhaus.abuse.ch/url/1065096/

Cape

https://www.capesandbox.com/analysis/147898/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

a̵c̵c̸i̵d̷e̵n̷t̴a̷l̴r̵e̷b̸e̴l̸ commented on 2021-05-02 10:59:44 UTC

============================================================
MBC behaviors list (github.com/accidentalrebel/mbcscan):
============================================================
0) [B0009] Anti-Behavioral Analysis::Virtual Machine Detection
1) [C0027.001] Cryptography Micro-objective::AES::Encrypt Data