Rewterz Threat Alert – Chaos Ransomware – Active IOCs
November 22, 2022Rewterz Threat Alert – LokiBot Malware – Active IOCs
November 22, 2022Severity
High
Analysis Summary
In the past few years Orcus was known as Schnorchel, is a Remote Access Trojan with some odd activity. This RAT enables attackers to create plugins using a custom development library and offers a robust core feature set that makes it one of the most dangerous malicious programs in its class. The ability of Orcus RAT include:
- Keylogging and remote administration
- Stealing system information and credentials
- Taking screenshots, recording video from Webcams, recording audio from microphones, and disabling webcam light
- Executing remote code execution and Denial-of-Service
- Exploring/editing registry
- Detecting VMs
- Reverse Proxying
- Real-Time Scripting
- Advanced Plugin System
Government entities, financial services organizations, information technology service providers, and consultancies are the main target sectors of Orcus RAT
Impact
- Credential Theft
- Financial Loss
Indicators of Compromise
MD5
a15c9a856753e623bd53b6e06967fe2d
44ae8ad1d370d40fd924f60578de705a
70bfd396ff4140c9a0e2b310fc2cb6dd
SHA-256
37dca6fead2c458e48bb710355fc277cc4ec0c9566c6db7fc84f65f2f3b006d3
7f86c0996827afa6134bffea4989e75c93098afa4fd5f3e4817934391b94b7c3
f628eeeb7907149170499cc4892f2f8a324efd40033f101b1bab08bf91bcb1da
SHA-1
a37b98d1370b49408767830a3b91b405611295bf
fcd41347811e78a309752a22a9963bdb522734db
08a36eaa443f367a406833c4fae71558df36e841
Remediation
- Block all threat indicators at your respective controls.
- Search for IOCs in your environment.