Rewterz Threat Advisory – Multiple Cisco Products Vulnerabilities
February 27, 2023Rewterz Threat Advisory – CVE-2022-43923 – IBM Maximo Application Suite Vulnerability
February 27, 2023Rewterz Threat Advisory – Multiple Cisco Products Vulnerabilities
February 27, 2023Rewterz Threat Advisory – CVE-2022-43923 – IBM Maximo Application Suite Vulnerability
February 27, 2023Severity
High
Analysis Summary
Orcus RAT (Remote Access Trojan) is a type of malicious software that allows an attacker to gain unauthorized access to a victim’s computer system. Once installed on a computer, Orcus RAT can perform a wide range of activities, such as stealing sensitive information, monitoring the victim’s activities, and controlling the victim’s computer remotely. Orcus RAT is sold as a “legitimate” remote administration tool, but it is often used for malicious purposes. It can be used to perform various malicious activities, such as stealing login credentials, monitoring keystrokes, stealing sensitive files, taking screenshots, recording audio and video, and even controlling the victim’s computer remotely. This RAT is typically spread through phishing emails, malicious downloads, and software vulnerabilities. Once it infects a system, it can be very difficult to detect and remove. Prevention is key, and users should always be cautious when opening emails or downloading software from untrusted sources.
In the past few years, Orcus known as Schnorchel enables attackers to create plugins using a custom development library and offers a robust core feature set that makes it one of the most dangerous malicious programs in its class. The ability of Orcus RAT include:
- Keylogging and remote administration
- Stealing system information and credentials
- Taking screenshots, recording video from Webcams, recording audio from microphones, and disabling webcam light
- Executing remote code execution and Denial-of-Service
- Exploring/editing registry
- Detecting VMs
- Reverse Proxying
- Real-Time Scripting
- Advanced Plugin System
Government entities, financial services organizations, information technology service providers, and consultancies are the main target sectors of Orcus RAT
Impact
- Credential Theft
- Financial Loss
Indicators of Compromise
MD5
- b3c049b9160e55f747cf584b109aa3a2
- 203d479f9429a21e92b94181db34c427
- 5b57d2022c736cd5218df873456104e1
SHA-256
- 9a938f47030e9b34dcee96382fae40ed2f980299e1ced3a04c19c859b24ae40c
- 29c34406bc0b9ae5c44474529917fd6e2177f66381131aa2ede5bfb6da334d96
- c2def6823301dd51f674bfae8cae527f0fa450a835bc2f3e3d91197f7e53b250
SHA-1
- 7731a49d69b16377c0acf234fa037278bc741923
- 884ed48a71c71dad1601253e95c9ff2f6251a26c
- ed8ad733c18308d669ca2b470ee07de061ff1aa2
Remediation
- Block all threat indicators at your respective controls.
- Search for Indicators of compromise (IOCs) in your environment utilizing your respective security controls
- Emails from unknown senders should always be treated with caution.
- Never trust or open ” links and attachments received from unknown sources/senders.
- Patch and upgrade any platforms and software timely and make it into a standard security policy. Prioritize patching known exploited vulnerabilities and zero-days.
- Enable antivirus and anti-malware software and update signature definitions in a timely manner. Using multi-layered protection is necessary to secure vulnerable assets