id: orcus-rat-trojan

info:
  name: Orcus RAT Trojan - Detect
  author: pussycat0x
  severity: info
  description: |
    Orcus has been advertised as a Remote Administration Tool (RAT) since early 2016. It has all the features that would be expected from a RAT and probably more. The long list of the commands is documented on their website. But what separates Orcus from the others is its capability to load custom plugins developed by users, as well as plugins that are readily available from the Orcus repository.
  reference:
    - https://github.com/montysecurity/C2-Tracker/blob/main/tracker.py
  metadata:
    verified: true
    max-request: 1
    shodan-query: product:'Orcus RAT Trojan'
  tags: network,c2,ir,osint,cti,orcus,rat

tcp:
  - inputs:
      - data: 160301007e0100007a03036609c7af2b4c85eaf3675a276eeee7025342c2e03855f07f7622645e02f49fb1000010130113021303002f000a00130039000401000041002b0009080303030203040300000d001a0018040106010403060308040806080708080809080b02010203003300020000000a000c000a001700180019001d0100
        type: hex

    host:
      - "{{Hostname}}"
    port: 10134
    read-size: 1024

    matchers:
      - type: word
        words:
          - "OrcusServerCertificate0"
# digest: 490a0046304402207b13e8a2e2c67354b586033ca2c1312856ff430c583f1d3f63c58ed63c82ac81022001fce4324315f6390e3dc40049cb95b4f1826fe6a238e36debdaac66b5071e12:922c64590222798bb761d5b6d8e72950