Rewterz Threat Alert – Orcus RAT – Active IOCs

Severity

High

Analysis Summary

Orcus RAT (Remote Access Trojan) is a type of malicious software that allows an attacker to gain unauthorized access to a victim’s computer system. Once installed on a computer, Orcus RAT can perform a wide range of activities, such as stealing sensitive information, monitoring the victim’s activities, and controlling the victim’s computer remotely. Orcus RAT is sold as a “legitimate” remote administration tool, but it is often used for malicious purposes. It can be used to perform various malicious activities, such as stealing login credentials, monitoring keystrokes, stealing sensitive files, taking screenshots, recording audio and video, and even controlling the victim’s computer remotely. This RAT is typically spread through phishing emails, malicious downloads, and software vulnerabilities. Once it infects a system, it can be very difficult to detect and remove. Prevention is key, and users should always be cautious when opening emails or downloading software from untrusted sources.

In the past few years, Orcus known as Schnorchel enables attackers to create plugins using a custom development library and offers a robust core feature set that makes it one of the most dangerous malicious programs in its class. The ability of Orcus RAT include:

• Keylogging and remote administration 
• Stealing system information and credentials 
• Taking screenshots, recording video from Webcams, recording audio from microphones, and disabling webcam light 
• Executing remote code execution and Denial-of-Service 
• Exploring/editing registry 
• Detecting VMs 
• Reverse Proxying 
• Real-Time Scripting 
• Advanced Plugin System

Government entities, financial services organizations, information technology service providers, and consultancies are the main target sectors of Orcus RAT

Impact

• Credential Theft
• Financial Loss

Indicators of Compromise

MD5

• b3c049b9160e55f747cf584b109aa3a2
• 203d479f9429a21e92b94181db34c427
• 5b57d2022c736cd5218df873456104e1

SHA-256

• 9a938f47030e9b34dcee96382fae40ed2f980299e1ced3a04c19c859b24ae40c
• 29c34406bc0b9ae5c44474529917fd6e2177f66381131aa2ede5bfb6da334d96
• c2def6823301dd51f674bfae8cae527f0fa450a835bc2f3e3d91197f7e53b250

SHA-1

• 7731a49d69b16377c0acf234fa037278bc741923
• 884ed48a71c71dad1601253e95c9ff2f6251a26c
• ed8ad733c18308d669ca2b470ee07de061ff1aa2

Remediation

• Block all threat indicators at your respective controls.
• Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls
• Emails from unknown senders should always be treated with caution.
• Never trust or open ” links and attachments received from unknown sources/senders.
• Patch and upgrade any platforms and software timely and make it into a standard security policy. Prioritize patching known exploited vulnerabilities and zero-days.
• Enable antivirus and anti-malware software and update signature definitions in a timely manner. Using multi-layered protection is necessary to secure vulnerable assets