Loading malware…
oRAT is a Go-based remote access trojan targeting Linux systems, with a documented macOS variant. It provides remote administration of compromised hosts, including command and shell execution, file upload and download, proxying and tunneling, port scanning, and embedded SSH/SFTP functionality. Linux variants can disable SELinux, establish persistence through a system service masquerading as a firewall-related component, masquerade their process, and conceal process information. A macOS variant supports shell access, file transfer, proxy connections, port scanning, screenshot capture, archive operations, and self-deletion; it has been distributed in an unsigned disk image impersonating Bitget software that executes a payload through an installer preinstallation script. oRAT has been associated with Earth Berberoka-related activity and the Gambling Goblin operation, which compromised Linux web servers at Brazilian government, educational, commercial, healthcare, and media organizations. The name ORat has also been used for a distinct Windows loader associated with BRONZE PRESIDENT/Mustang Panda; that tool uses WMI event-consumer persistence and should not be conflated with the Go-based Linux and macOS oRAT RAT.
3 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
“Its toolkit includes DownPro, AlphaAgent, oRAT RAT, 3snake credential stealer, SSH brute-forcer, and reconnaissance tools.”
“oRAT can establish persistence through a service that mimics a legitimate firewall component.”
ORat — CTU researchers have only observed this basic loader tool in the context of BRONZE PRESIDENT intrusions. ORat is the name assigned by the malware author, as denoted by the program debug database string in the analyzed sample: D:\vswork\Plugin\ORat\build\Release\ORatServer\Loader.pdb.
28 distinct techniques documented for this family, organized by ATT&CK tactic.
"developed custom malware for use in their operations."
If oRAT lacks privileges for a system-wide install, it falls back to per-user persistence through a user service and a cron entry.
AlphaAgent executes commands through /bin/sh -c, while oRAT passes operator input to sh -c.
the target would need to override default security warnings from Gatekeeper... or users have been pre-groomed to bypass Gatekeeper during a social engineering engagement of some kind.
If oRAT lacks privileges for a system-wide install, it falls back to per-user persistence through a user service and a cron entry.
“oRAT similarly establishes persistence through a service designed to resemble a normal firewall-related component.”
The tool uses the Windows Management Instrumentation (WMI) event consumer for persistence by installing a script to the system's WMI registry. For example, ORat uses a WMI event consumer to maintain its presence on a compromised host.
If oRAT lacks privileges for a system-wide install, it falls back to per-user persistence through a user service and a cron entry.
“oRAT similarly establishes persistence through a service designed to resemble a normal firewall-related component.”
The tool uses the Windows Management Instrumentation (WMI) event consumer for persistence by installing a script to the system's WMI registry. For example, ORat uses a WMI event consumer to maintain its presence on a compromised host.
“Several tools use disguises, encryption, and memory-only unpacking.”
The binary doesn’t define any Symbols, and outputting the list of Sections tells us that the file has been packed with UPX.
AlphaAgent can... hide under system-service names. oRAT can establish persistence through a service that mimics a legitimate firewall component.
“The malware can be disguised as a legitimate system service to reduce suspicion. oRAT similarly establishes persistence through a service designed to resemble a normal firewall-related component.”
orat/cmd/agent/app.(*App).KillSelf
AlphaAgent and oRAT bind-mount over their own /proc/<pid> entries; AlphaAgent can also hide processes and connections through a rootkit component.
a succinct bash shell script whose purpose is to deliver a payload to the /tmp directory, give the payload executable permissions, and then launch it.
oRAT disables SELinux enforcement with setenforce 0 during its preparation routine.
orat/cmd/agent/app.(*App).PortScan
orat/cmd/agent/app.(*App).Info
orat/cmd/agent/app.(*App).DownloadFile ... UploadFile ... Zip ... Unzip
BruteForcer attempts concurrent SSH logins using supplied username/password lists; oRAT embeds an SSH and SFTP server.
During one intrusion, the threat actors gained administrator access to all systems within a targeted business unit and installed their remote access tools on 80% of the hosts.
orat/cmd/agent/app.(*App).Screenshot
Depending on the config, it will call one of orat_protocol.DialTCP, orat_protocol.DialSTCP or orat_protocol.DialSUDP to establish a connection. The TCP protocols leverage smux while the SUDP protocol leverages QUIC.
AlphaAgent primarily uses gRPC over HTTPS; oRAT multiplexes HTTP requests over TCP, TLS/TCP, or QUIC/UDP sessions.
AlphaAgent bundles a SOCKS5 proxy, yamux multiplexer, Ligolo-style relay, and a relay listener that forwards traffic upstream.
“After gaining access, the attackers can deploy additional tools through DownPro, a loader capable of retrieving payloads such as the ChUser backdoor, AlphaAgent and oRAT.”
“AlphaAgent supported remote command execution (RCE), file transfers, tunneling and host discovery, while oRAT provided remote administration.”
oRAT layers a multiplexed session over TCP, TLS/TCP, or QUIC/UDP and carries HTTP requests inside the established session.
AlphaAgent encrypts configurations and job/result messages with AES-GCM beneath TLS; PasswordHarvester exfiltrates credentials RC4-encrypted and Base64-encoded.
orat/cmd/agent/app.(*App).UploadFile
97 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
14 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.