Loading malware…
oRAT is a Go-based remote-access trojan used primarily against Linux systems and also documented in a macOS variant. It provides remote administration of compromised hosts, including command-shell access, file upload and download, network proxying, port scanning, screenshot capture, archive handling, and self-deletion. Linux oRAT variants can disable SELinux, establish system-service persistence, expose embedded SSH/SFTP functionality, and conceal execution through process masquerading and process-hiding techniques. It has been associated with the Chinese-speaking Earth Berberoka cluster and the Gambling Goblin web-server compromise and gambling-focused SEO-fraud operation. The macOS variant was distributed in an unsigned installer masquerading as cryptocurrency-related software; its payload was a UPX-packed Go binary with encrypted embedded command-and-control configuration and support for TCP-, smux-, and QUIC-based communications. A separately documented Windows tool named ORat, attributed to BRONZE PRESIDENT/Mustang Panda, is described as a basic loader using WMI event-consumer persistence; available information does not establish that it is the same malware family as the Go-based Linux and macOS oRAT.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
3 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
oRAT, one of the Linux tools in that arsenal, was documented by Trend Micro in April 2022 as Earth Berberoka malware.
oRAT, one of the Linux tools in that arsenal, was documented by Trend Micro in April 2022 as Earth Berberoka malware.
ORat — CTU researchers have only observed this basic loader tool in the context of BRONZE PRESIDENT intrusions. ORat is the name assigned by the malware author, as denoted by the program debug database string in the analyzed sample: D:\vswork\Plugin\ORat\build\Release\ORatServer\Loader.pdb.
27 distinct techniques documented for this family, organized by ATT&CK tactic.
If oRAT lacks privileges for a system-wide install, it falls back to per-user persistence through a user service and a cron entry.
oRAT installs itself to /usr/local/bin/xtables-addons and registers a systemd service named xtables-addons to start at boot as root.
The tool uses the Windows Management Instrumentation (WMI) event consumer for persistence by installing a script to the system's WMI registry. For example, ORat uses a WMI event consumer to maintain its presence on a compromised host.
If oRAT lacks privileges for a system-wide install, it falls back to per-user persistence through a user service and a cron entry.
oRAT installs itself to /usr/local/bin/xtables-addons and registers a systemd service named xtables-addons to start at boot as root.
The tool uses the Windows Management Instrumentation (WMI) event consumer for persistence by installing a script to the system's WMI registry. For example, ORat uses a WMI event consumer to maintain its presence on a compromised host.
“Most were wrapped in packing and virtualization layers to slow analysis.”
The binary doesn’t define any Symbols, and outputting the list of Sections tells us that the file has been packed with UPX.
Depending on the config, it will call one of orat_protocol.DialTCP, orat_protocol.DialSTCP or orat_protocol.DialSUDP to establish a connection. The TCP protocols leverage smux while the SUDP protocol leverages QUIC.
AlphaAgent primarily uses gRPC over HTTPS; oRAT multiplexes HTTP requests over TCP, TLS/TCP, or QUIC/UDP sessions.
AlphaAgent bundles a SOCKS5 proxy, yamux multiplexer, Ligolo-style relay, and a relay listener that forwards traffic upstream.
orat/cmd/agent/app.(*App).DownloadFile | only contains a preinstall script, a succinct bash shell script whose purpose is to deliver a payload to the /tmp directory
“AlphaAgent supported remote command execution (RCE), file transfers, tunneling and host discovery, while oRAT provided remote administration.”
47 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
10 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A remote-administration backdoor in the Linux toolkit. Its use was one of the reported overlaps connecting Gambling Goblin to Earth Berberoka.
Remote-access Trojan and Linux-capable backdoor in the Gambling Goblin/Earth Berberoka toolset.
A Go-based Linux RAT with TCP, TLS, and QUIC transports; multiplexed C2; shell execution; file transfer; port scanning; SOCKS proxying and forwarding; an embedded SSH/SFTP server; systemd, user-service, or cron persistence; SELinux disabling; and process/procfs hiding.
Basic loader used by BRONZE PRESIDENT that persists via a WMI event consumer, communicates with its C2 using a custom raw socket protocol over TCP port 80, and decompresses and executes payloads received from the server.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.