MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 898d1732911c458363da98639e408ae9db60c6f13708cfda9b654b163812915e. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


OrcusRAT


Vendor detections: 10


Intelligence 10 IOCs 1 YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 898d1732911c458363da98639e408ae9db60c6f13708cfda9b654b163812915e
SHA3-384 hash: 2a88f89a0984271377fa149c1a061cab9248b0d73ee30b2e32e3c5e8569dc2ce61ceb1e4cd6b039d8e812be3b8c36e7a
SHA1 hash: 192fa9b249b667cbbba9d737cad77f46addebb0f
MD5 hash: 857a1cd1e64ce81bf57b85d154db5291
humanhash: jig-zulu-oranges-fish
File name:857A1CD1E64CE81BF57B85D154DB5291.exe
Download: download sample
Signature OrcusRAT
Create hunting rule
File size:972'288 bytes
First seen:2021-09-10 15:11:18 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'744 x AgentTesla, 19'609 x Formbook, 12'242 x SnakeKeylogger)
ssdeep 24576:JF5vfMkwg1GlAulGKKWMxni95Uu7F/bOGkMci7RF5h9:r5vfFwyGlAusPWMxnqUu789WFD
Threatray 80 similar samples on MalwareBazaar
TLSH T11E252326B764C124C84D4DB6DD23D2F11239FD89FD46860F72503B2F6E7679B8A02E92
dhash icon 0000004020000000 (4 x OrcusRAT)
Reporter abuse_ch
Tags:exe OrcusRAT


Avatar
abuse_ch
OrcusRAT C2:
185.175.56.98:50721

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
185.175.56.98:50721 https://threatfox.abuse.ch/ioc/219763/

Intelligence

File Origin
# of uploads :
1
# of downloads :
906
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
857A1CD1E64CE81BF57B85D154DB5291.exe
Verdict:
Malicious activity
Analysis date:
2021-09-10 15:12:50 UTC
Tags:
rat orcus trojan
Link:
https://app.any.run/tasks/d5737d7b-d527-4e8c-93c3-9c07cab33d55

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/186929/
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Launching a process
Creating a process with a hidden window
Sending a UDP request
Using the Windows Management Instrumentation requests
DNS request
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/4badfc10-fcfa-4da1-a085-83cafa250245
Result
Threat name:
Orcus
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/848884
Signature
.NET source code contains potential unpacker
Antivirus detection for dropped file
Connects to many ports of the same IP (likely port scanning)
Creates an undocumented autostart registry key
Drops executables to the windows directory (C:\Windows) and starts them
Found malware configuration
Installs a global keyboard hook
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments
Tries to harvest and steal browser information (history, passwords, etc)
Yara detected Costura Assembly Loader
Yara detected Orcus RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 481313 Sample: 1RX6Qzn7bl.exe Startdate: 10/09/2021 Architecture: WINDOWS Score: 100 53 time.google.com 2->53 71 Found malware configuration 2->71 73 Malicious sample detected (through community Yara rule) 2->73 75 Multi AV Scanner detection for dropped file 2->75 77 6 other signatures 2->77 8 1RX6Qzn7bl.exe 8 2->8         started        12 svchost.exe 2->12         started        15 svchost.exe 1 2->15         started        17 4 other processes 2->17 signatures3 process4 dnsIp5 47 C:\Users\user\AppData\...\DllProtection.exe, PE32 8->47 dropped 49 C:\Users\user\AppData\Local\Temp\RegAsm.exe, PE32 8->49 dropped 51 C:\Users\user\AppData\...\1RX6Qzn7bl.exe.log, ASCII 8->51 dropped 85 Creates an undocumented autostart registry key 8->85 19 RegAsm.exe 8->19         started        24 powershell.exe 18 8->24         started        26 powershell.exe 20 8->26         started        28 3 other processes 8->28 69 127.0.0.1 unknown unknown 12->69 file6 signatures7 process8 dnsIp9 55 185.175.56.98, 49811, 49816, 50721 HOSTHATCHUS Germany 19->55 43 C:\Windows\SysWOW64\WindowsInput.exe, PE32 19->43 dropped 45 C:\Windows\SysWOW64\WindowsInput.exe.config, XML 19->45 dropped 79 Drops executables to the windows directory (C:\Windows) and starts them 19->79 81 Tries to harvest and steal browser information (history, passwords, etc) 19->81 83 Installs a global keyboard hook 19->83 30 WindowsInput.exe 19->30         started        63 3 other IPs or domains 24->63 33 conhost.exe 24->33         started        57 dns.google 8.8.4.4 GOOGLEUS United States 26->57 59 192.168.2.1 unknown unknown 26->59 65 3 other IPs or domains 26->65 35 conhost.exe 26->35         started        61 time.google.com 28->61 67 8 other IPs or domains 28->67 37 conhost.exe 28->37         started        39 conhost.exe 28->39         started        41 conhost.exe 28->41         started        file10 signatures11 process12 signatures13 87 Antivirus detection for dropped file 30->87 89 Multi AV Scanner detection for dropped file 30->89
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/898d1732911c458363da98639e408ae9db60c6f13708cfda9b654b163812915e/
Threat name:
ByteCode-MSIL.Trojan.Pwsx
Create hunting rule
Status:
Malicious
First seen:
2021-09-07 05:36:52 UTC
AV detection:
16 of 28 (57.14%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=rggromurdrcygy62tbrz4qek5hnwbrxrg4em7wu3mvfrmoassfpa._file
Verdict:
malicious
Similar samples:
1a4284cd084b609aa03892894e379c630505b5e4b9ccfc278138d36668f4526f
OrcusRAT
28027fae1edf2324a8165c9f1a82273f958385c4947e8750a6bdcf29ec2e4906
OrcusRAT
50c1c541f9daea24b578ac94fd709b1214207a38cbc2ba3b36b2b0e81d0e4ee1
OrcusRAT
53943895601cbc79561cb30c9957715400d82a255d97ce36fe1b383bf3c240da
OrcusRAT
5fe03c646fcc7a7b912b2266fe54c645f203d22bfae171bf5f089e9934711dbb
OrcusRAT
6a95a31549b0ce73fc61664173ebab87da541094d8749894f05c707e543cbe1e
OrcusRAT
bf5d5c28bec7bdcf41fad771fd465ba6bb9a56e053c9470a6e10293466109d3c
OrcusRAT
d7f7b600a0291f227e18c700916cbd7552aeb595e51a1ab918e164255cc29b1b
OrcusRAT
da027d0065fa09308efb93370437a0495a3bcec56325fb9846d807066a9abf86
OrcusRAT
fc8351c509bfd6fca2168f7b5652184ab4dd273ae85da25ee7ff500a8477b7de
OrcusRAT
+ 70 additional samples on MalwareBazaar
Result
Malware family:
orcus
Create hunting rule
Score:
  10/10
Tags:
family:orcus botnet:client rat spyware stealer
Link:
https://tria.ge/reports/210910-sk7mmsace5/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of SetWindowsHookEx
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in System32 directory
Suspicious use of SetThreadContext
Loads dropped DLL
Executes dropped EXE
Orcurs Rat Executable
Orcus
Malware Config
C2 Extraction:
216.250.97.121:50721
Unpacked files
SH256 hash:
a5a8e1638138ea730906d1e0e5b4a50e1cb864433a7ddef8acf287259e03f2a6
MD5 hash:
772e50344e0022b2daebef9a1873221b
SHA1 hash:
f837ec856a98146442828e5affdac66dbe183a46
Link:
https://www.unpac.me/results/6ef66730-919c-4bde-9a91-e9943b116567/
SH256 hash:
308ee66399ba5a31d790db6d61ddd67d14f16aa438786d6368d2051477e90bad
MD5 hash:
e488fba68a86f6e79f47c4d936788f5a
SHA1 hash:
57d978f691ed9dbcb8326ec30fd6f27dda2eedc7
Link:
https://www.unpac.me/results/6ef66730-919c-4bde-9a91-e9943b116567/
SH256 hash:
898d1732911c458363da98639e408ae9db60c6f13708cfda9b654b163812915e
MD5 hash:
857a1cd1e64ce81bf57b85d154db5291
SHA1 hash:
192fa9b249b667cbbba9d737cad77f46addebb0f
Link:
https://www.unpac.me/results/6ef66730-919c-4bde-9a91-e9943b116567/
Malware family:
OrcusRAT
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/898d1732911c/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/898d1732911c458363da98639e408ae9db60c6f13708cfda9b654b163812915e

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:pe_imphash
Create hunting rule
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/186929/

Comments