BLACK FRIDAY: 2-for-1 offer NOVEMBER 20 - 26 See details
19
Global rank
52 infographic chevron month
Month rank
52 infographic chevron week
Week rank
392
IOCs

Orcus is a modular Remote Access Trojan with some unusual functions. This RAT enables attackers to create plugins using a custom development library and offers a robust core feature set that makes it one of the most dangerous malicious programs in its class.

RAT
Type
Canada
Origin
1 April, 2016
First seen
11 July, 2024
Last seen
Also known as
Schnorchel

How to analyze Orcus RAT with ANY.RUN

RAT
Type
Canada
Origin
1 April, 2016
First seen
11 July, 2024
Last seen

IOCs

IP addresses
147.185.221.21
147.185.221.16
193.161.193.99
191.101.34.192
5.29.153.174
78.101.85.87
147.185.221.17
147.78.103.228
31.44.184.52
45.81.39.83
94.156.10.119
1.1.1.1
89.149.39.9
84.247.114.115
37.243.169.65
172.94.54.88
104.250.175.179
44.203.122.41
15.235.3.1
128.59.46.185
Hashes
29b16da245c4a20304dc477083a329576fe7c8b9185c0b6d7b0619f89c488460
b62f0a77e4d2f75c351aa1f2f30a3a60500924733360dcec19efa3cfbe3dbc69
03df234ce4e39fbd3f36155202e6ca5db2c7bf29135365933fe2a3ed21e8d060
eac95e487c8fe6d3a429ef7aec6687965237207c64afe30c9f459db68fdd34d2
1c26609e8645b561b94cbe10692f2b884282bb9048e0632446934ec13c0d5fb0
5807993896e5266bf8b3ce9dfea11faa2db0958c8697934508cea06babf3bfb0
776bbb5f7d88e12b3925b9a2fbf5e3760d1b182ae9e19688931f5018ab3091d2
b76b69c16976ae70838529ce9dac1246c46fe6e97eb0e22cef7d71db759955b9
c4be652b27f0c5a2f056f13a9cec1fe7acaa49051f6e9606cd2317f5016262eb
f106e1114d34ed4347cbf1dd539f3ef54440a25a6d5f02a1352d00286ce2ade3
68fd186960956d73385efe2ea6e976ab07dd662683d0839681f63c50fb7bed94
a9e834db3677b8f5db9641e4542df977b5fc4580546586ebac6ce2e1b47c72ec
c785ce2f074b931706a4eb79e8c5da5a810ecccc3098553a54230c03b4e52df0
26736198b2aa7c9bd8eb2cc8206741cb6b47987dca1d182d408325e155b88e6c
5428a227285e9e14f1e67754065bf7a93c4eb74c23b1ff4d05d2727c52e62462
8e77ce48190a2b6054e961574bb59499cb9733fc3bc4c43264e54877ce0e83d0
244aea8d7600ea5c62effa39a8c4a45f76700698bc0d78b0298002bbed1a5f84
a26cece522787afe05307603a3bcaa3d283259be9631060d5a34d292dc552fc3
df56bc44e0f7231530889c633ed48c674ca4abcdc7d53a0b5c98940d8b975966
626a7a8e89ffdc8e1101a8a304964ecf4e840c178fa9822e1487311b44ba91c7
Domains
5.tcp.eu.ngrok.io
4.tcp.eu.ngrok.io
0.tcp.eu.ngrok.io
7.tcp.eu.ngrok.io
4.tcp.ngrok.io
6.tcp.eu.ngrok.io
any-or.gl.at.ply.gg
16.ip.gl.ply.gg
s7vety-47274.portmap.host
dfwfdsfsdasd.project-nightfall.com
conflicker-35081.portmap.host
64770.client.sudorat.ru
64770.client.sudorat.top
s7vety-27063.portmap.host
32154.client.sudorat.ru
32154.client.sudorat.top
schoolserver-36828.portmap.host
conflicker1-54843.portmap.io
period-disabilities.gl.at.ply.gg
229.ip.ply.gg
Last Seen at

Recent blog posts

post image
Malware Trends Report: Q2, 2024 
watchers 1338
comments 0
post image
A Guide to Common Encryption Algorithms in Mo...
watchers 359
comments 0
post image
Search for Network Threats by Suricata in TI...
watchers 682
comments 0

What is Orcus RAT?

Orcus, previously known as Schnorchel, is a Remote Access Trojan, which enables remote control of infected systems. Although Orcus RAT malware is mostly a typical member of the RAT family, it has some competitive advantages over similar malware and unique features.

In addition, Orcus RAT has a modular structure, and it gives users the ability to create custom plugins for the malware. The modularity of this trojan gives it higher than standard scalability and management, allowing it to tailor the malware to the needs of various campaigns.

The first time we heard about this malware was from a forum post by one of its authors. The post announced the development of a new RAT that was named Schnorchel at the time. Soon after the announcement, the malware became commercially available under the name “Orcus RAT” and was presented to the public as legal software for remote administration, similar to Teamviewer. Interestingly, the authors claimed that the abbreviation RAT stood for Remote Administration Tool and not Remote Access Trojan.

General description of Orcus RAT

Apart from a few exceptions, Orcus RAT malware has a relatively standard but robust feature set for a technologically advanced Remote Access Trojan. The malware can grab screenshots and record user input, activate the webcam, steal passwords, record audio, and steal information. In addition, Orcus comes with the ability to detect if it’s being launched on a virtual machine to complicate the analysis by security researchers.

The functions described above already make this malware quite capable. However, it offers a few unusual functions that enhance its functionality. Namely, the RAT in question supports plugins, and besides offering the ability to build them, it has a whole library of already created plugins that attackers can choose from. Furthermore, Orcus RAT plugins can be written in multiple languages, including C#, C++, and VB.Net.

To make the development of extensions more streamlined, malware creators rolled out a dedicated development environment. What’s more, those who lack the skills to build plugins from scratch on their own can follow detailed tutorials and benefit from well-maintained documentation libraries.

Additionally, Orcus had a Github page where authors have published samples of created plugins.

Another relatively unique feature that the malware authors packed into this virus is real-time scripting. Real-time scripting allows Orcus to write and run code on machines that it infected.

Speaking of Orcus RAT malware authors, we know that the virus was developed by a 36-year-old John Revesz, also known as “Armada" on the underground forums. In 2019, Canadian authorities accused Revesz of operating an international malware distribution scheme.

In his defense, Revesz claimed that the RAT is, in fact, a legitimate program for remote administration, and his company “Orcus Technologies” is a legal business. However, an examination of the functionality clearly revealed that the software is intended for malicious use cases, which resulted in the arrest of Revesz.

It is believed that Revesz wasn’t working alone. Therefore, a joint development effort theory makes sense, especially considering the technological complexity of certain aspects of this malware. For example, Orcus RAT consists of multiple components, with the control panel being a separate component. In addition, the server that the malware establishes a connection with after infection does not hold an admin panel. This architecture provides several advantages to the attackers, for example, the ability to share access to infected PCs from the same server. Additionally, it allows for greater scalability or infected networks.

Orcus RAT malware analysis

A video recorded in the ANY.RUN interactive malware hunting service displays the execution process of Orcus RAT in real-time.

Read a detailed analysis of OrcusRAT in our blog.

process_graph_of_orcus_rat_execution

Figure 1: Displays the execution process of the Orcus RAT. This visualization was generated by ANY.RUN.

text_report_of_orcus_rat_execution

Figure 2: Displays a text report generated by ANY.RUN. Text reports are useful for demonstration and can be customized by a user to show necessary data.

Orcus RAT execution process

The execution process of the Orcus RAT is straightforward. This malware often disguises itself as a cheat code or crack, so it is mostly delivered to a system as an archive file with the compressed executable file inside. Since this trojan was written in C#, it often uses .NET infrastructure, available in Windows. To compile the C# source code, our sample started Visual C# compiler, which, in turn, started the Resource File To COFF Object Conversion Utility. After it was compiled, the executable file began its execution and malicious activity. Note that Orcus remote access tool does not always make its way into an infected system, as described above. In some cases, it comes as a precompiled executable file which only needs a user to double click on it to start the execution.

Orcus RAT malware distribution

Orcus RAT commonly makes its way into target machines as a downloadable attachment in malicious spam emails. Campaigns are often highly targeted and aim at organizations rather than at individuals.

Attackers use phishing and social engineering to trick victims into downloading an attachment or visiting a link that points to a server that holds the payload. In order to begin execution, Orcus does require user input. However, in most cases, it is unable to infect the system without user interaction.

How to detect Orcus RAT?

This malware creates files that allow analysts to detect it with a high degree of certainty. To identify the Orcus RAT, open the "Advanced details of process" by clicking on the "More info" button and switch events display to "Raw." This trojan often creates files with "Orcus" in the names, so all we need is to find such a file. To make it easier, type the word "Orcus" in the filename field. If such a file is found, you can be sure that Orcus RAT is in front of you.

files_created_by_orcus_rat

Figure 3: Files created by Orcus RAT

Conclusion

Orcus RAT malware is a sophisticated trojan that offers some unusual functions on top of solid basic info-stealing capabilities. Technical complexity was complemented by an affordable price of just 40 USD. Today, interested users can download a leaked version of Orcus for free. Unfortunately, this, along with excellent support and documentation, ensured the popularity of Orcus RAT.

Since its deployment in 2016, researchers have been observing Orcus RAT campaigns, and the popularity of this malware is still on the rise. As a result, we can expect several new attacks utilizing malicious software in the future.

Researchers can analyze Orcus RAT using the ANY.RUN malware hunting service to study this malware or other RATS such as Quasar RAT or njRAT. ANY.RUN is an interactive sandbox that allows researchers to stop and correct the simulation at any point, which ensures pure research results. In addition, useful information that can be obtained from the analysis can be added to our growing database of cyber threats to help combat internet crime worldwide.

HAVE A LOOK AT

Adwind screenshot
Adwind
adwind trojan
Adwind RAT, sometimes also called Unrecom, Sockrat, Frutas, jRat, and JSocket, is a Malware As A Service Remote Access Trojan that attackers can use to collect information from infected machines. It was one of the most popular RATs in the market in 2015.
Read More
Agent Tesla screenshot
Agent Tesla
agenttesla trojan rat stealer
Agent Tesla is spyware that collects information about the actions of its victims by recording keystrokes and user interactions. It is falsely marketed as a legitimate software on the dedicated website where this malware is sold.
Read More
Amadey screenshot
Amadey
amadey
Amadey is a formidable Windows infostealer threat, characterized by its persistence mechanisms, modular design, and ability to execute various malicious tasks.
Read More
Arkei screenshot
Arkei
arkei stealer
Arkei is a stealer type malware capable of collecting passwords, autosaved forms, cryptocurrency wallet credentials, and files.
Read More
AsyncRAT screenshot
AsyncRAT
asyncrat
AsyncRAT is a RAT that can monitor and remotely control infected systems. This malware was introduced on Github as a legitimate open-source remote administration software, but hackers use it for its many powerful malicious functions.
Read More
WarZone screenshot
WarZone
warzone avemaria stealer trojan rat
WarZone RAT is a remote access trojan, which is written in C++ and offered as a malware-as-a-service. It packs a wide range of capabilities, from stealing victims’ files and passwords to capturing desktop activities. WarZone RAT is primarily distributed via phishing emails and receives regular updates from its C2.
Read More

Our website uses cookies. By visiting the pages of the site, you agree to our Privacy Policy