MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 dc1717a5b1bf17a487bc61296bb5fd9ac3104dd20089ec84f1cb71a37f397760. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


OrcusRAT


Vendor detections: 10


Intelligence 10 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: dc1717a5b1bf17a487bc61296bb5fd9ac3104dd20089ec84f1cb71a37f397760
SHA3-384 hash: 6bc787e4da0f1d0ce28838b85f7b0ee23bfa9e7dc9801137dfad574993e78131e49513ffedc16d1f42c3cc61e5853a44
SHA1 hash: 38e15b60ba05c5bc0f0ed1d2654b9bc1086ded11
MD5 hash: 30382caa8fc5dd3dfe5c590081f25236
humanhash: shade-skylark-pasta-river
File name:dc1717a5b1bf17a487bc61296bb5fd9ac3104dd20089ec84f1cb71a37f397760
Download: download sample
Signature OrcusRAT
Create hunting rule
File size:861'696 bytes
First seen:2021-02-28 07:22:40 UTC
Last seen:2021-02-28 08:59:52 UTC
File type:Executable exe
MIME type:application/x-dosexec
imphash f34d5f2d4577ed6d9ceec516c1f5a744 (48'738 x AgentTesla, 19'596 x Formbook, 12'241 x SnakeKeylogger)
ssdeep 12288:nS/s6ga+v4KT2DCkRclHwnvKQx2/bmnc0OPUW0T9YFqRV4GPgdohDbJExZ:S/Sa+vtRHwS1bNPb0TGFq68gdoh/Jm
Threatray 44 similar samples on MalwareBazaar
TLSH 870501AE3ECE949DFA7E01F157869CB412D4CD9E0DA0167E248D36ABA33154970FCE90
Reporter JAMESWT_WT
Tags:OrcusRAT

Intelligence

File Origin
# of uploads :
2
# of downloads :
1'580
Origin country :
n/a
Vendor Threat Intelligence
Malware family:
n/a
ID:
1
File name:
Bolt AIO V2.exe
Verdict:
Malicious activity
Analysis date:
2021-02-25 18:42:24 UTC
Tags:
rat orcus
Link:
https://app.any.run/tasks/292a61d9-a1ff-4b75-aa01-b55869a3d7ae

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
OrcusRAT
Create hunting rule
Link:
https://www.capesandbox.com/analysis/119932/
Detection(s):
SecuriteInfo.com.Variant.Kazy.211507.20853.30204.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
DNS request
Sending a UDP request
Creating a file in the %AppData% directory
Creating a process from a recently created file
Creating a file
Launching the default Windows debugger (dwwin.exe)
Creating a file in the %temp% directory
Launching a process
Creating a process with a hidden window
Deleting a recently created file
Creating a window
Unauthorized injection to a recently created process
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Result
Threat name:
Orcus
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/620885
Signature
.NET source code contains potential unpacker
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Binary contains a suspicious time stamp
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Sigma detected: Dot net compiler compiles file from suspicious location
Yara detected Costura Assembly Loader
Yara detected Orcus RAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 signatures2 2 Behavior Graph ID: 359435 Sample: IJOuXqFuii Startdate: 28/02/2021 Architecture: WINDOWS Score: 100 47 Malicious sample detected (through community Yara rule) 2->47 49 Antivirus detection for dropped file 2->49 51 Antivirus / Scanner detection for submitted sample 2->51 53 8 other signatures 2->53 8 IJOuXqFuii.exe 6 2->8         started        process3 file4 33 C:\Users\user\AppData\Roaming\Bolt.exe, PE32 8->33 dropped 35 C:\Users\user\AppData\...\IJOuXqFuii.exe.log, ASCII 8->35 dropped 37 C:\Users\user\...\SteamMachineService.exe, PE32 8->37 dropped 11 Bolt.exe 18 8->11         started        15 SteamMachineService.exe 1 8->15         started        process5 file6 39 C:\Program Files\Orcus\Orcus.exe, PE32 11->39 dropped 41 C:\Users\user\AppData\...\mjcuyk9j.cmdline, UTF-8 11->41 dropped 43 C:\Program Files\Orcus\Orcus.exe.config, XML 11->43 dropped 55 Antivirus detection for dropped file 11->55 57 Machine Learning detection for dropped file 11->57 17 csc.exe 3 11->17         started        20 Orcus.exe 2 11->20         started        23 WerFault.exe 23 9 15->23         started        25 conhost.exe 15->25         started        signatures7 process8 dnsIp9 31 C:\Users\user\AppData\Local\...\mjcuyk9j.dll, PE32 17->31 dropped 27 conhost.exe 17->27         started        29 cvtres.exe 1 17->29         started        45 10.7.0.18, 1738 unknown unknown 20->45 file10 process11
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/dc1717a5b1bf17a487bc61296bb5fd9ac3104dd20089ec84f1cb71a37f397760/
Threat name:
ByteCode-MSIL.Trojan.Wacatac
Create hunting rule
Status:
Malicious
First seen:
2021-02-26 05:40:48 UTC
AV detection:
20 of 29 (68.97%)
Threat level:
  5/5
Verdict:
malicious
Similar samples:
05bb212dd186eaa7c2fa17ad094fd56f55fa203f488f1e150532aa23c86c9bf8
OrcusRAT
0c3a1e4598b32bfcdf0226964c07af858c56e22c112fc4719f833738733958b8
OrcusRAT
30f878c3d1b2e365f13e2085d39e3c9289dadf191c47dd1abcb273b5fac081b3
OrcusRAT
4e963b9768467dcf18787fe4b197a1b9efe76a2108cdf0f73c6f81407c6dca95
OrcusRAT
74d6d0213855d53e4edad91ee620009558a9df2f6f925be9e81ba54df4b3b11d
OrcusRAT
7bf8ffd612e903c781abab704e0f9aa5c736a50343f6cad3faf53c3b62cf80eb
OrcusRAT
9efca9fb9aadcdec3f3e23fda67899c67dda0d7178636a5691e15d6b62e01649
OrcusRAT
b9657cd9005b01b162ce90306ba1b7c7c3df3551fba5f008efd780086f461e72
OrcusRAT
c9ad44b2a060ff9e8350a3cea2b178f7c384d6976f938f5248d16a2afa7ea426
OrcusRAT
f7e7dfe0a2e59a746679694100b4549408a7e5513d3b1cf4bee0ba981f5e1703
OrcusRAT
+ 34 additional samples on MalwareBazaar
Result
Malware family:
orcus
Create hunting rule
Score:
  10/10
Tags:
family:orcus rat spyware stealer
Link:
https://tria.ge/reports/210228-2nyqp54zhx/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Enumerates physical storage devices
Program crash
Drops file in Windows directory
Drops desktop.ini file(s)
Loads dropped DLL
Executes dropped EXE
Orcus
Orcus Main Payload
Unpacked files
SH256 hash:
0a4ea68c23b6b807607e441caa60f2e2d2fe75dbb59b59fa2a9421fb6598c8ca
MD5 hash:
061a79832fab5b5a82c7bf5e1a2825e4
SHA1 hash:
53705ffeb1e9e3f9174f5fc6420c838b0f22d408
Link:
https://www.unpac.me/results/3a72c226-63d5-4d4c-b370-9a5558612b00/
SH256 hash:
dc1717a5b1bf17a487bc61296bb5fd9ac3104dd20089ec84f1cb71a37f397760
MD5 hash:
30382caa8fc5dd3dfe5c590081f25236
SHA1 hash:
38e15b60ba05c5bc0f0ed1d2654b9bc1086ded11
Link:
https://www.unpac.me/results/3a72c226-63d5-4d4c-b370-9a5558612b00/
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Kazy
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/dc1717a5b1bf17a487bc61296bb5fd9ac3104dd20089ec84f1cb71a37f397760

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape
Cape
https://www.capesandbox.com/analysis/119932/

Comments