MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 8fa0c76caa93c8a47464600bbcbb3984fed0d2afcb9055389aad98fb254dcb44. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


OrcusRAT


Vendor detections: 14


Intelligence 14 IOCs 1 YARA 6 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 8fa0c76caa93c8a47464600bbcbb3984fed0d2afcb9055389aad98fb254dcb44
SHA3-384 hash: 1c9b54a3e1207306bd5531ccdbd2bd4c5ae071bff19508db2690af7b35005dbbd4094234f42e66835526eafdd2876ae9
SHA1 hash: 7f6968d1d22b1e4de1aa02b5a6c9c144b726f777
MD5 hash: 3cbbb9f92210df310b5b8a974bff35b6
humanhash: speaker-september-ink-princess
File name:3cbbb9f92210df310b5b8a974bff35b6.exe
Download: download sample
Signature OrcusRAT
Create hunting rule
File size:3'672'576 bytes
First seen:2022-05-09 14:31:40 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'652 x AgentTesla, 19'463 x Formbook, 12'204 x SnakeKeylogger)
ssdeep 98304:EEfy/6iRYykMZkQ72XaLxdmFJfeKcZWV0ASSSVjZjD1f9pU:a/6iKyv5qEQZetuSVj91f9
Threatray 107 similar samples on MalwareBazaar
TLSH T1A90623E13241E6E7CE57973753EE4EA11171153AA538F30B2F98B3E81223B1F09692E5
TrID 72.5% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13)
10.4% (.EXE) Win64 Executable (generic) (10523/12/4)
6.5% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
4.4% (.EXE) Win32 Executable (generic) (4505/5/1)
2.0% (.EXE) OS/2 Executable (generic) (2029/13)
Reporter abuse_ch
Tags:exe OrcusRAT


Avatar
abuse_ch
OrcusRAT C2:
20.89.177.186:21245

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
20.89.177.186:21245 https://threatfox.abuse.ch/ioc/549237/

Intelligence

File Origin
# of uploads :
1
# of downloads :
463
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
orcus
Create hunting rule
ID:
1
File name:
3cbbb9f92210df310b5b8a974bff35b6.exe
Verdict:
Malicious activity
Analysis date:
2022-05-09 18:10:07 UTC
Tags:
rat orcus
Link:
https://app.any.run/tasks/f6dd5043-066c-44d7-9e4f-4247a33fb402

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection(s):
SecuriteInfo.com.Trojan.GenericKD.48966096.18850.4997.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Searching for the window
Сreating synchronization primitives
Using the Windows Management Instrumentation requests
Creating a file
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
fareit obfuscated packed replace.exe update.exe
Link:
https://www.filescan.io/uploads/627925ffbd5c76586e2530d3/reports/c2409018-1fc2-45bb-8558-b35113766635/overview
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Orcus RAT
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/6b72d645-d12f-4ef8-b972-e49a5e75b30a
Result
Threat name:
Orcus
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/990248
Signature
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Drops executables to the windows directory (C:\Windows) and starts them
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Snort IDS alert for network traffic
Uses schtasks.exe or at.exe to add and modify task schedules
Yara detected Orcus RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 622745 Sample: MOOhGN4rMA.exe Startdate: 09/05/2022 Architecture: WINDOWS Score: 100 57 Snort IDS alert for network traffic 2->57 59 Malicious sample detected (through community Yara rule) 2->59 61 Antivirus detection for dropped file 2->61 63 7 other signatures 2->63 9 MOOhGN4rMA.exe 6 2->9         started        13 svchost.exe 2->13         started        16 svchost.exe 9 1 2->16         started        18 5 other processes 2->18 process3 dnsIp4 47 C:\Users\user\AppData\Roaming47lutLFcY.exe, PE32 9->47 dropped 49 C:\Users\user\AppData\Local\...\tmpFA1C.tmp, XML 9->49 dropped 51 C:\Users\user\AppData\...\MOOhGN4rMA.exe.log, ASCII 9->51 dropped 67 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 9->67 69 Uses schtasks.exe or at.exe to add and modify task schedules 9->69 71 Injects a PE file into a foreign processes 9->71 20 MOOhGN4rMA.exe 9 9->20         started        24 schtasks.exe 1 9->24         started        53 192.168.2.1 unknown unknown 13->53 55 127.0.0.1 unknown unknown 16->55 file5 signatures6 process7 file8 39 C:\Windows\SysWOW64\WindowsInput.exe, PE32 20->39 dropped 41 C:\Program Files (x86)\...\RuntimeBroker.exe, PE32 20->41 dropped 43 C:\Windows\SysWOW64\WindowsInput.exe.config, XML 20->43 dropped 45 2 other malicious files 20->45 dropped 65 Drops executables to the windows directory (C:\Windows) and starts them 20->65 26 WindowsInput.exe 2 4 20->26         started        29 RuntimeBroker.exe 5 20->29         started        31 conhost.exe 24->31         started        signatures9 process10 signatures11 73 Antivirus detection for dropped file 26->73 75 Multi AV Scanner detection for dropped file 26->75 77 Machine Learning detection for dropped file 26->77 79 Injects a PE file into a foreign processes 29->79 33 schtasks.exe 29->33         started        35 RuntimeBroker.exe 29->35         started        process12 process13 37 conhost.exe 33->37         started       
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/8fa0c76caa93c8a47464600bbcbb3984fed0d2afcb9055389aad98fb254dcb44/
Threat name:
ByteCode-MSIL.Trojan.AgentTesla
Create hunting rule
Status:
Malicious
First seen:
2022-05-05 07:29:25 UTC
File Type:
PE (.Net Exe)
Extracted files:
8
AV detection:
26 of 41 (63.41%)
Threat level:
  5/5
Detection(s):
Malicious file
Link:
https://check.spamhaus.org/check/?searchterm=r6qmo3fkspeki5demaf3zozzqt7nbuvpzoifkoe2vwmpwjknznca._file
Verdict:
malicious
Similar samples:
030de3a6ac5f11501e8a9492846e393fc8be584f4dd68355bc54a70bb35ac4a7
OrcusRAT
3573aef05e6255e2579fc47d55765871702a351b9d7362a9d855ee92ed28aadb
OrcusRAT
50c1c541f9daea24b578ac94fd709b1214207a38cbc2ba3b36b2b0e81d0e4ee1
OrcusRAT
6a95a31549b0ce73fc61664173ebab87da541094d8749894f05c707e543cbe1e
OrcusRAT
6b2bc89a82c41241a24f0a8c7972b563e30303bf7c277d767ac5766510e8f03e
OrcusRAT
be539522e3244b0134ead1d8f18727d6ce46cc6a97fd8d7b4961c02dae6b2b90
OrcusRAT
e21d43df96e42ae29354ecf4b21e803c0c3bfd9a706f5f7ee334b1893ae92c6a
OrcusRAT
e877ee10428a6a81a83caaa9222466efbc4635a719613d63f813d8dc49baef8f
OrcusRAT
+ 97 additional samples on MalwareBazaar
Result
Malware family:
orcus
Create hunting rule
Score:
  10/10
Tags:
family:orcus botnet:swidden evasion persistence rat spyware stealer
Link:
https://tria.ge/reports/220509-rv9pbadee8/
Behaviour
Creates scheduled task(s)
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Drops file in Program Files directory
Drops file in System32 directory
Suspicious use of SetThreadContext
Adds Run key to start application
Maps connected drives based on registry
Checks BIOS information in registry
Checks computer location settings
Loads dropped DLL
Executes dropped EXE
Looks for VMWare Tools registry key
Looks for VirtualBox Guest Additions in registry
Orcurs Rat Executable
Orcus
Malware Config
C2 Extraction:
20.89.177.186:21245
Unpacked files
SH256 hash:
0a8aed493986e60d410d1bae6a9b16be94793aad6cc6ec1eb659334903f3e7fd
MD5 hash:
3e8dc9ec3832b0618c0648b3d2566649
SHA1 hash:
ff52f3f7b98aa7c8f316687745bcd8c292747542
Link:
https://www.unpac.me/results/28c32a76-08a1-4d61-abab-ac9268cd656d/
SH256 hash:
60bb48d2b16b9d8dc48cb9983ab7757ba8aea400ea50caaf1ee3480a94116a41
MD5 hash:
29bd34f1ef5800f2295a1907e462729c
SHA1 hash:
ac5ba1149636669bfa9b6d9f24e15758a30986db
Link:
https://www.unpac.me/results/28c32a76-08a1-4d61-abab-ac9268cd656d/
SH256 hash:
ec31b101577890b8652e45efe7bc6ca874a34b9ca7edee3ecf29201b7b6555a6
MD5 hash:
4556a59321363fb2a3e7b97e61ce21b5
SHA1 hash:
6dfe1483e53e5b149613a50362705848edf09e7f
Link:
https://www.unpac.me/results/28c32a76-08a1-4d61-abab-ac9268cd656d/
SH256 hash:
488ee517e5bd814f6efc7a7011d9ac49f653a14e9f20746963ab34d272d1441f
MD5 hash:
3e4aaffa1ce87dd5e3578749a8df05e3
SHA1 hash:
553eb65c15cb1af518703591596ac0d4b3796099
Link:
https://www.unpac.me/results/28c32a76-08a1-4d61-abab-ac9268cd656d/
SH256 hash:
cb0e7ad49146a8f7ea70864a3165c9b6d397f375fbd504754536c6af1b8d7273
MD5 hash:
c8c2e095cc6af685bffd8378d6429829
SHA1 hash:
dfead8e879f7720f97dd9aeaa2dec4f5ac8a96c7
Link:
https://www.unpac.me/results/28c32a76-08a1-4d61-abab-ac9268cd656d/
SH256 hash:
dfc9f796b706f54efae069c6748f09abbd4019b4601bb1a11c46f81aa6724048
MD5 hash:
b54bc8549278de36c17cfc2deebcdcc3
SHA1 hash:
87f2be200c200d2af067a78a120700bca328e3d0
Link:
https://www.unpac.me/results/28c32a76-08a1-4d61-abab-ac9268cd656d/
SH256 hash:
79823e47436e129def4fba8ee225347a05b7bb27477fb1cc8be6dc9e9ce75696
MD5 hash:
39f524c1ab0eb76dfd79b2852e5e8c39
SHA1 hash:
428018e1701006744e34480b0029982a76d8a57d
Link:
https://www.unpac.me/results/28c32a76-08a1-4d61-abab-ac9268cd656d/
SH256 hash:
8fa0c76caa93c8a47464600bbcbb3984fed0d2afcb9055389aad98fb254dcb44
MD5 hash:
3cbbb9f92210df310b5b8a974bff35b6
SHA1 hash:
7f6968d1d22b1e4de1aa02b5a6c9c144b726f777
Link:
https://www.unpac.me/results/28c32a76-08a1-4d61-abab-ac9268cd656d/
Malware family:
OrcusRAT
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/8fa0c76caa93/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/8fa0c76caa93c8a47464600bbcbb3984fed0d2afcb9055389aad98fb254dcb44

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:INDICATOR_EXE_Packed_Fody
Create hunting rule
Author:ditekSHen
Description:Detects executables manipulated with Fody
Rule name:INDICATOR_SUSPICIOUS_GENInfoStealer
Create hunting rule
Author:ditekSHen
Description:Detects executables containing common artifcats observed in infostealers
Rule name:malware_Agenttesla_type2
Create hunting rule
Author:JPCERT/CC Incident Response Group
Description:detect Agenttesla in memory
Reference:internal research
Rule name:MAL_Lokibot_Stealer
Create hunting rule
Description:Detects Lokibot Stealer Variants
Rule name:pe_imphash
Create hunting rule
Rule name:Skystars_Malware_Imphash
Create hunting rule
Author:Skystars LightDefender
Description:imphash

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments