Loading malware…
Orcus RAT is a Windows-focused .NET remote access trojan that has been sold since the mid-2010s as a commercial remote administration product but has been repeatedly used in malicious intrusion campaigns. It provides full remote control of infected systems and supports a plugin architecture that extends its functionality. Documented capabilities include credential theft and password retrieval, keylogging, remote desktop control, webcam and microphone access, command execution, file, process and registry management, and distributed denial-of-service functionality. Some versions and plugins have also been associated with anti-analysis features, virtual-machine evasion, watchdog-based self-relaunch, and covert webcam use by disabling indicator lights.
Orcus RAT has been delivered through multiple intrusion vectors, most prominently phishing campaigns using complaint-themed lures, cryptocurrency-themed lures, and malicious attachments or links. It has also been distributed via trojanized software and cracked applications on file-sharing sites, including fake trading tools and pirated productivity software. Additional reporting links it to smishing-driven delivery through trojanized installers and to exploit-based Office document chains that retrieve and execute the payload in later stages.
Observed infection chains commonly emphasize defense evasion and fileless or memory-resident execution. Campaigns have used VBScript, PowerShell, batch and JavaScript downloaders, SmartAssembly-protected loaders, process hollowing, and in-memory injection into legitimate .NET processes. Persistence mechanisms have included Startup-folder shortcuts, scheduled tasks, RunOnce execution, and watchdog components that relaunch the malware if terminated. Some campaigns paired Orcus RAT with other malware families such as RevengeRAT, AVE_MARIA, BitRAT, Cerberus, and XMRig, either as alternative payloads or companion malware.
Orcus RAT has been used against a broad victim set, including government entities, financial services organizations, IT service providers, consultancies, cryptocurrency users, and Korean users seeking pirated software. Public reporting has also tied the malware to campaigns targeting South American organizations and to widespread criminal use enabled by leaked or broadly available tooling. Law-enforcement action has targeted the malware’s developer, reflecting longstanding scrutiny over its marketing, feature set, and repeated use in unauthorized compromise.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
35 distinct techniques documented for this family, organized by ATT&CK tactic.
FortiGuards Labs’ Kadena Threat Intelligence System (KTIS) has spotted a new phishing campaign that targets bitcoin investors by offering Gunbot
An attachment with the filename sourcode.vbs.zip is actually an archive that contains a simple VB Script with the same filename, which when executed downloads a file
Earlier malware campaigns contained a hyperlink that directed potential victims to the malicious content responsible for initiating the malware infection. The attacker made use of the SendGrid email delivery service to redirect victims to an attacker-controlled malware distribution server.
The dropper also copies itself over to %APPDATA%\Roaming\trfgtf\rfgrf.exe and creates and starts the rfgrf.exe.bat file... The bat file executes the copy of the loader every 60 seconds.
registers PowerShell commands on the task scheduler to periodically install the latest malware.
it allows the threat actor to use basic control features such as collecting system information, file/registry/process tasks, and executing commands.
running this will execute an obfuscated PowerShell command... Besides the feature that runs the actual installer program, it also includes encoded PowerShell commands.
The dropper also copies itself over to %APPDATA%\Roaming\trfgtf\rfgrf.exe and creates and starts the rfgrf.exe.bat file... The bat file executes the copy of the loader every 60 seconds.
The dropper also copies itself over to %APPDATA%\Roaming\trfgtf\rfgrf.exe and creates and starts the rfgrf.exe.bat file... The bat file executes the copy of the loader every 60 seconds.
registers PowerShell commands on the task scheduler to periodically install the latest malware.
Revenge RAT fileless components that execute reconnaissance and hollowing attacks on legitimate Windows processes to avoid being detected... executes a known process hollowing technique on a legitimate Windows process (RegAsm.exe).
running this will execute an obfuscated PowerShell command... Decoding the encoded PowerShell command reveals the following.
Although the extension suggests it is a JPEG image file, it is actually a PE binary file.
Revenge RAT fileless components that execute reconnaissance and hollowing attacks on legitimate Windows processes to avoid being detected... executes a known process hollowing technique on a legitimate Windows process (RegAsm.exe).
The first URL represents the Downloader, which executes a known process hollowing technique on a legitimate Windows process (RegAsm.exe)... CreateProcess in suspend, Unmap and Map and then resume thread on the written data.
In this case, it uses components of the Microsoft .NET framework, MSBuild.exe and RegAsm.exe, as shells to hide their malicious processes.
To make sure that only one instance of the malware is running, the system checks for the existence of a mutex named “dgonfUsV”.
the malware collects basic information such as the infected system’s username and IP address
the malware collects basic information such as the infected system’s username and IP address
These are, of course, on top of the obviously ominous features such as password retrieval and key logging that are normally seen in Remote Access Trojans.
Orcus RAT communicates with the following Orcus server... Because Orcus RAT by default uses the TLC protocol in communications with the C&C server, packets are encrypted.
They pointed the DDNS over to the Portmap service to provide an additional layer of infrastructure obfuscation. Portmap is a service designed to facilitate external connectivity to systems that are behind firewalls or otherwise not directly exposed to the internet.
when executed downloads a file from https[:]//bltcointalk.com/flashplayer27pp_ka_install.jpeg
37 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
11 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
.NET Stubs: Sowing the Seeds of Discord (PureCrypter) Aberebot AbstractEmu AdoBot 404 Keylogger Agent Tesla Amadey AsyncRAT Ave Maria BitRAT BluStealer Formbook LimeRAT Loki Password Stealer (PWS) Nanocore RAT Orcus RAT Quasar RAT Raccoon RedLine Stealer WhisperGate
Remote access trojan delivered via trojanized installers in smishing campaigns; described as capable of credential theft and intercepting authentication codes, with propagation via victims' contact lists.
A remote access trojan whose delivery stages, downloader component, and C2 infrastructure are described as overlapping with this AVE_MARIA campaign.
Remote access trojan distributed via Korean file-sharing sites. It provides remote control, system information collection, file/registry/process management, command execution, remote desktop, keylogging, webcam control, and RDP control by installing RDP Wrapper and creating an 'OrcusRDP' account. It communicates with a separate Orcus server acting as C2 and uses encrypted communications.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.