Severity

High

Analysis Summary

In the past few years Orcus was known as Schnorchel, is a Remote Access Trojan with some odd activity. This RAT enables attackers to create plugins using a custom development library and offers a robust core feature set that makes it one of the most dangerous malicious programs in its class. The ability of Orcus RAT include:

• Keylogging and remote administration 
• Stealing system information and credentials 
• Taking screenshots, recording video from Webcams, recording audio from microphones, and disabling webcam light 
• Executing remote code execution and Denial-of-Service 
• Exploring/editing registry 
• Detecting VMs 
• Reverse Proxying 
• Real-Time Scripting 
• Advanced Plugin System

Government entities, financial services organizations, information technology service providers, and consultancies are the main target sectors of Orcus RAT

Impact

• Credential Theft
• Financial Loss

Indicators of Compromise

MD5

a15c9a856753e623bd53b6e06967fe2d
44ae8ad1d370d40fd924f60578de705a
70bfd396ff4140c9a0e2b310fc2cb6dd

SHA-256

37dca6fead2c458e48bb710355fc277cc4ec0c9566c6db7fc84f65f2f3b006d3
7f86c0996827afa6134bffea4989e75c93098afa4fd5f3e4817934391b94b7c3
f628eeeb7907149170499cc4892f2f8a324efd40033f101b1bab08bf91bcb1da

SHA-1

a37b98d1370b49408767830a3b91b405611295bf
fcd41347811e78a309752a22a9963bdb522734db
08a36eaa443f367a406833c4fae71558df36e841

Remediation

• Block all threat indicators at your respective controls.
• Search for IOCs in your environment.