MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 88f3320f4bcd533c568b9ba53205deb1b0e430c3c32a1dfa0bfded03851114a8. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

OrcusRAT

Vendor detections: 10

Intelligence 10 IOCs 2 YARA 10 File information Comments 1

SHA256 hash:	88f3320f4bcd533c568b9ba53205deb1b0e430c3c32a1dfa0bfded03851114a8
SHA3-384 hash:	ef171b1f5fbef83580d554ac0bf70b5650dd81755a885faaca82ba15f94e8f57a880c639d4ef46b6ea6540d4acdd0657
SHA1 hash:	55ed61f7bd39147201a022ec3f83edfc8c58e002
MD5 hash:	658cb5f3bd26b13bb619c625501d7283
humanhash:	pip-robin-oven-december
File name:	658CB5F3BD26B13BB619C625501D7283.exe
Download:	download sample
Signature	OrcusRAT Create hunting rule
File size:	928'768 bytes
First seen:	2021-05-21 17:35:40 UTC
Last seen:	2021-05-21 18:27:35 UTC
File type:	exe
MIME type:	application/x-dosexec
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep	24576:LAw4MROxnFj3IrkxrrcI0AilFEvxHPtiooq:LWMi1UqrrcI0AilFEvxHP
Threatray	50 similar samples on MalwareBazaar
TLSH	EC15BF013FACBD07C1BE3679B7731ACA07B8E90A6052FB4E195851AE1D9BB01BD11367
Reporter	abuse_ch
Tags:	exe OrcusRAT

abuse_ch

OrcusRAT C2:
3.129.187.220:16788

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOC	ThreatFox Reference
3.129.187.220:16788	https://threatfox.abuse.ch/ioc/53613/
3.133.207.110:16788	https://threatfox.abuse.ch/ioc/53614/

Intelligence

File Origin

# of uploads :

# of downloads :

1'128

Origin country :

n/a

Vendor Threat Intelligence

Malware family:

n/a

ID:

File name:

658CB5F3BD26B13BB619C625501D7283.exe

Verdict:

Malicious activity

Analysis date:

2021-05-21 17:51:18 UTC

Tags:

rat orcus

Link:

https://app.any.run/tasks/e73b7cac-8204-49a3-81c1-7e1b70842670

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection(s):

Win.Packed.Passwordstealera-9803747-0

Win.Packed.Generic-9805849-0

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file in the %AppData% subdirectories

Enabling the 'hidden' option for recently created files

Creating a process from a recently created file

Creating a file

Sending a UDP request

Setting a keyboard event handler

Creating a window

Creating a file in the %AppData% directory

DNS request

Connection attempt

Unauthorized injection to a recently created process

Enabling autorun

Result

Verdict:

MALICIOUS

Details

Windows PE Executable

Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.

Result

Threat name:

Orcus

Detection:

malicious

Classification:

troj.spyw.evad

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/787507

Signature

.NET source code contains potential unpacker

.NET source code contains very large strings

.NET source code references suspicious native API functions

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Contains functionality to disable the Task Manager (.Net Source)

Contains functionality to register a low level keyboard hook

Creates an undocumented autostart registry key

Installs a global keyboard hook

Machine Learning detection for dropped file

Machine Learning detection for sample

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected Costura Assembly Loader

Yara detected Orcus RAT

Behaviour

Behavior Graph:

Download SVG

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/88f3320f4bcd533c568b9ba53205deb1b0e430c3c32a1dfa0bfded03851114a8/

Threat name:

ByteCode-MSIL.Trojan.Orcus

Status:

Malicious

First seen:

2021-05-18 07:57:07 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

38 of 47 (80.85%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=rdzted2lzvjtyvultostebo6wgyoimgdymvb36ql7xwqhbircsua._file

Verdict:

malicious

Result

Malware family:

orcus

Score:

10/10

Tags:

family:orcus rat spyware stealer

Link:

https://tria.ge/reports/210521-dtzh4fq5ds/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Loads dropped DLL

Executes dropped EXE

Orcus

Orcus Main Payload

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/88f3320f4bcd533c568b9ba53205deb1b0e430c3c32a1dfa0bfded03851114a8

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	Agenttesla_type2 Create hunting rule
Author:	JPCERT/CC Incident Response Group
Description:	detect Agenttesla in memory
Reference:	internal research

Rule name:	CAP_HookExKeylogger Create hunting rule
Author:	Brian C. Bell -- @biebsmalwareguy
Reference:	https://github.com/DFIRnotes/rules/blob/master/CAP_HookExKeylogger.yar

Rule name:	Chrome_stealer_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Chrome in files like avemaria

Rule name:	INDICATOR_EXE_Packed_Fody Create hunting rule
Author:	ditekSHen
Description:	Detects executables manipulated with Fody

Rule name:	INDICATOR_SUSPICIOUS_GENInfoStealer Create hunting rule
Author:	ditekSHen
Description:	Detects executables containing common artifcats observed in infostealers

Rule name:	Keylog_bin_mem Create hunting rule
Author:	James_inthe_box
Description:	Contains Keylog

Rule name:	MAL_BackNet_Nov18_1 Create hunting rule
Author:	Florian Roth
Description:	Detects BackNet samples
Reference:	https://github.com/valsov/BackNet

Rule name:	pe_imphash Create hunting rule

Rule name:	Select_from_enumeration Create hunting rule
Author:	James_inthe_box
Description:	IP and port combo

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

No further information available

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

a̵c̵c̸i̵d̷e̵n̷t̴a̷l̴r̵e̷b̸e̴l̸ commented on 2021-05-21 18:23:21 UTC

============================================================
MBC behaviors list (github.com/accidentalrebel/mbcscan):
============================================================
0) [B0009] Anti-Behavioral Analysis::Virtual Machine Detection
1) [C0027.001] Cryptography Micro-objective::AES::Encrypt Data