February 17, 2025
Proactive Defense: The Importance of Incident Response Planning in Cybersecurity
Rewterz Threat Alert – Microsoft’s ms-appinstaller Protocol Abused by Threat Groups – Active IOCs
February 8, 2022Rewterz Threat Alert – Ukraine Under Attack – Active IOCs
February 8, 2022Rewterz Threat Alert – Microsoft’s ms-appinstaller Protocol Abused by Threat Groups – Active IOCs
February 8, 2022Rewterz Threat Alert – Ukraine Under Attack – Active IOCs
February 8, 2022
Severity
High
Analysis Summary
In the past few years Orcus was known as Schnorchel, is a Remote Access Trojan with some odd activity. This RAT enables attackers to create plugins using a custom development library and offers a robust core feature set that makes it one of the most dangerous malicious programs in its class. The ability of Orcus RAT
- Keylogging and remote administration
- Stealing system information and credentials
- Taking screenshots, recording video from Webcams, recording audio from microphones, and disabling webcam light
- Executing remote code execution and Denial-of-Service
- Exploring/editing registry
- Detecting VMs
- Reverse Proxying
- Real-Time Scripting
- Advanced Plugin System
Impact
- Credential Theft
- Financial Loss
Indicators of Compromise
Filename
- i8fp5koko[.]dll
- Orcus[.]exe
MD5
- 77b6c43975833df79a02c9d6b3079e32
- c74a943d5f3c9a059bde9ec1db2e82d9
- 1d522a6c8ca3e00918799b61fd7c7b3c
SHA-256
- 4ebcfe7a62a49894a0c2701284f5e4c7183d1ebc138225b9a2c8fb5d6b271e43
- 6f2d51ee6984c00ceb30ca2b08f8599c2272a40b699b69adfb8faf1939ced7df
- 2c4259c9471eb714276f38b8c2fe892b327e8de4151d22a8712370030522bb8e
SHA-1
- 59f603f2073efe6b61ea202f806246c7f3fe8d3d
- 29b2061e940e4a66841b668cf533b4d8630f08b1
- 7cca0a8eabe4841e415783b9639abedb7745183f
Remediation
- Block all the threat indicators at your respective controls.
- Search for IOCs in your environment.