Orcus RAT

Orcus is a modular Remote Access Trojan with some unusual functions. This RAT enables attackers to create plugins using a custom development library and offers very robust core featureset, that make it one of the most dangerous malicious programs in its class.

Type
RAT
Origin
Canada
First seen
1 April, 2016
Last seen
16 April, 2021
Also known as
Schnorchel
Global rank
24
Week rank
8
Month rank
14
IOCs
3167

What is Orcus RAT?

Orcus, previously known as Schnorchel, is a Remote Access Trojan — a malware that enables remote control of infected systems. Although Orcus RAT malware is mostly a typical member of the RAT family, it has some competitive advantages over similar malware and unique features.

In addition, Orcus RAT has a modular structure and it gives users the ability to create custom plugins for the malware. The modularity of this trojan gives it higher than standard scalability and management, allowing to tailor the malware to the needs of various campaigns.

The first time we heard about this malware was from a forum post by one of its authors. The post announced the development of a new RAT that was named Schnorchel at the time. Soon after the announcement, the malware became commercially available under the name “Orcus RAT” and was presented to the public as a legal software for remote administration, similar to Teamviewer. Interestingly, authors claimed that the abbreviation RAT stood for Remote Administration Tool and not Remote Access Trojan.

General description of Orcus RAT

Apart from a few exceptions, Orcus RAT malware has a relatively standard but robust feature set for a technologically advanced Remote Access Trojan. The malware can grab screenshots and record user input, activate the webcam, steal passwords, record audio and steal information. In addition, Orcus comes with the ability to detect if it’s being launched on a virtual machine to complicate the analysis by security researchers.

The functions described above already make this malware quite capable, however, it offers a few unusual functions that enhance its functionality. Namely, the RAT in question supports plugins and besides offering the ability to build them, it has a whole library of already created plugins that attackers can choose from. Orcus RAT plugins can be written in multiple languages, including C#, C++, and VB.Net.

To make the development of extensions more streamlined, malware creators rolled out a dedicated development environment. What’s more, those who lack the skills to build plugins from scratch on their own can follow detailed tutorials and benefit from well-maintained documentation libraries.

Additionally, Orcus had a Github page where authors have published samples of created plugins.

Another relatively unique feature that the malware authors packed into this virus is real-time scripting. Real-time scripting allows Orcus to write and run code on machines that it infected.

Speaking of Orcus RAT malware authors, we know that the virus was being developed by a 36-year-old John Revesz also known as “Armada" on the underground forums. In 2019, Canadian authorities accused Revesz of operating an international malware distribution scheme.

In his defense, Revesz claimed that the RAT is, in fact, a legitimate program for remote administration and his company “Orcus Technologies” is a legal business. However, an examination of the functionality clearly revealed that the software is intended for malicious use cases, which resulted in the arrest of Revesz.

It is believed that Revesz wasn’t working alone. A joint development effort theory makes sense, especially considering the technological complexity of certain aspects of this malware. For example, Orcus RAT consists of multiple components with the control panel being a separate component. The server that the malware establishes a connection with after infection does not hold an admin panel. This architecture provides several advantages to the attackers, for example, the ability to share access to infected PCs from the same server. Additionally, it allows for greater scalability or infected networks.

Orcus RAT malware analysis

A video recorded in the ANY.RUN interactive malware hunting service displays the execution process of Orcus RAT in real-time.

process_graph_of_orcus_rat_execution

Figure 1: Displays the execution process of the Orcus RAT. This visualization was generated by ANY.RUN.

text_report_of_orcus_rat_execution

Figure 2: Displays a text report generated by ANY.RUN. Text reports are useful for demonstration and can be customized by a user to show necessary data.

Orcus RAT execution process

The execution process of the Orcus RAT is simple and straightforward. This malware often disguises itself as some kind of cheat code or crack so it is mostly delivered to a system as an archive file with the compressed executable file inside. Since this trojan was written in C#, it often uses .NET infrastructure which is available in Windows. To compile the C# source code our sample started Visual C# compiler which, in turn, started the Resource File To COFF Object Conversion Utility. After it was compiled, the executable file began its execution and malicious activity. Note that Orcus remote access tool does not always make its way into an infected system as described above. In some cases, it comes as a precompiled executable file which only needs a user to double click on it to start the execution.

Orcus RAT malware distribution

Orcus RAT commonly makes its way into target machines as a downloadable attachment in malicious spam emails. Campaigns are often highly targeted and aim at organizations rather than at individuals.

Attackers use phishing and social engineering to trick victims into downloading an attachment or visiting a link that points to a server that holds the payload. In order to begin execution Orcus does require user input, in most cases it is unable to infect the system without user interaction.

How to detect Orcus RAT?

This malware creates files that allow analysts to detect it with a high degree of certainty. To identify the Orcus RAT, open the "Advanced details of process" by clicking on the "More info" button and switch events display to "Raw". This trojan often creates files with "Orcus" in the names, so all we need is to find such a file. To make it easier just type the word "Orcus" in the filename field. If such a file is found, you can be sure that Orcus RAT is in front of you.

files_created_by_orcus_rat

Figure 3: Files created by Orcus RAT

Conclusion

Orcus RAT malware is a sophisticated trojan that offers some unusual functions on top of solid basic info-stealing capabilities. Technical complexity was complemented by an affordable price of just 40 USD. Today, interested users can download a leaked version of Orcus for free. Unfortunately, this along with excellent support and documentation ensured the popularity of Orcus RAT.

Since its deployment in 2016, researchers have been observing Orcus RAT campaigns and the popularity of this malware is still on the rise. We can expect several new attacks utilizing malicious software in the future.

Researchers can analyze Orcus RAT using the ANY.RUN malware hunting service to study this malware. ANY.RUN is an interactive sandbox that allows researchers to stop and correct the simulation at any point which ensures pure research results. Useful information that can be obtained from the analysis can be added to our growing database of cyber threats to help combat internet crime all around the world.

IOCs

IP addresses
18.197.239.5
3.19.130.43
31.220.4.216
3.142.129.56
52.14.18.129
3.131.207.170
13.59.15.185
13.59.15.185
51.210.231.245
3.128.107.74
209.250.252.45
3.13.191.225
3.22.30.40
193.161.193.99
3.17.7.232
3.14.182.203
37.252.7.150
79.112.177.124
151.237.185.211
188.116.40.45
Hashes
44e1da6cdf3ec5c1984ac41eb7b748393012746c27000cafc5a25f1917236fad
7641e140b8abc51b176edd02a58a55ada70133f4fcdc44aef654edd40046f4a9
ad23e6df05ac4c5bfc62ea8923fb033b8dc9880142e3c566ceca231bbbb694dd
c4f67339b6f32375244f7de7563898f3b3bd93fcd3c282289d64367fb6b1d167
cc4d4c52b54169234118f77d53b26970b2d051687bdc65ff8f9d07a1dfdeea08
6944cfb835e2b598605c51b48320c0567045851878efc23204e688777d5dc547
8d880758549220154d2ff4ee578f2b49527c5fb76a07d55237b61e30bcc09e3a
1626ae8af4cd2875440e373973a6c5e32ae8f30ded02134bccd22d29bd55f792
d6cb06a6392525bebdd0d8faae09f2fa769b8f0b004aac75ac64c7ec2d015815
18eef59995488b5219d4c6ab0c9669c458356b758df710d508ead65e31cdca27
bcd8caa87c88041caf0037ea7583893aca39e17389bbb9c813aab35d833c13f7
f7619c7c95d5a82cd17dfc927c620351faa7af4c27b9e53b5b92df39733552d0
0790132410e845ccd23a8d94f8c52b64eef56f95ed9a8805b2f4952ab1218a65
47182a9b7240ab7f4c9fe675c301d3aa5534709342cd4f2e016d19ffcc867bd3
68e050006a6c1e43db5ce8d19a3fea3d29b74e04d91f915cf22f84e3159843c2
7eeac37929fd34533e835dc7c5f4924aced2f8a00a07d98ab8f59f94c16c127d
a232ca3a573535c972108093730396fad63beeea854c11e145c2a3efb7fba6f1
279c6a0742efad6910a3b741b7a27ee926c5fd2b80746f70d0b60961c867601e
d649c43cd4440adbb6600f76481c80d650c10decba7c498fab0612475c9bd0c6
5b01b7f4d0f1d5b82de038a28a56e81dc82333c6103e997770d45fe0151a76ef
Domains
2.tcp.eu.ngrok.io
yatzufn.ddns.net
WindowsAuthentication324-49629.portmap.host
majul.com
8.tcp.ngrok.io
booking.msg.bluhotels.com
booking.msg.bluhotels.com
bccd.duckdns.org
2.tcp.ngrok.io
3.tcp.ngrok.io
facexteste.hopto.org
filestlggtwerka.hopto.org
3a64aa8bcc04.ngrok.io
9a9168d13064.ngrok.io
b23bcfd244dc.ngrok.io
4916dbdc805b.ngrok.io
practicebetter.ngrok.io
b50562952bee.ngrok.io
516e39f56d87.ngrok.io
ff0c310658a8.ngrok.io

HAVE A LOOK AT

Adwind screenshot
Adwind
adwind trojan
Adwind RAT, sometimes also called Unrecom, Sockrat, Frutas, jRat and JSocket is a Malware As A Service Remote Access Trojan that attackers can use to collect information from infected machines. It was one of the most popular RATs in the market in 2015.
Read More
Agent Tesla screenshot
Agent Tesla
agenttesla trojan rat stealer
Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold.
Read More
Ave Maria screenshot
Ave Maria
avemaria stealer trojan rat
Ave Maria malware is a Remote Access Trojan that is also called WARZONE RAT. Hackers use it to control the PCs of their victims remotely and steal information from infected PCs. For example, they can remotely activate the camera to take pictures of a victim and send them to a control server.
Read More
Azorult screenshot
Azorult
azorult trojan rat
AZORult can steal banking information including passwords and credit card details as well as cryptocurrency. This constantly updated information stealer malware should not be taken lightly, as it continues to be an active threat.
Read More
Crimson RAT screenshot
Crimson RAT
crimson rat trojan
Crimson is a Remote Access Trojan — a malware that is used to take remote control of infected systems and steal data. This particular RAT is known to be used by a Pakistani founded cybergang that targets Indian military objects to steal sensitive information.
Read More
Danabot screenshot
Danabot
danabot trojan stealer
Danabot is an advanced banking Trojan malware that was designed to steal financial information from victims. Out of the Trojans in the wild this is one of the most advanced thanks to the modular design and a complex delivery method.
Read More