Orcus RAT hidden in Coca-Cola video

guest · Feb 7, 2019

Orcus RAT hidden in Coca-Cola video
February 5, 2019
https://www.enterprisetimes.co.uk/2019/02/05/orcus-rat-hidden-in-coca-cola-video/

Cybersecurity vendor Morphisec has released the details of a malware campaign distributing the Orcus Remote Access Trojan (RAT).

The RAT is hidden inside a Coca-Cola video and when the user watches the video, the RAT installs itself on their computer. This is not the first malware campaign, by a threat actor Morphisec calls PUSIKURAC, that uses the Orcus RAT.
How does it work?
The user clicks on a link that they believe is a video file containing a Ramadan-themed-Coca-Cola commercial. This starts a series of downloads and process that:

Uses a User Access Control (UAC) bypass technique to search for and hijack a process with the highest privileges on the machine / Uses that process to download the infected video /
This allows the malware attached to the video to then execute with the same privileges and install on the machine [...]
The malware uses the ConfuserEx obfuscation framework. This enables it to avoid detection by security software.
Interestingly, in the analysis, the Morphisec team point out that the software uses anti-VM techniques. This is almost certainly to limit detection by security teams.
Click to expand...

http://blog.morphisec.com/new-campaign-delivering-orcus-rat
[...] The eventvwr.exe, mmc and mscfile registry hijack clearly indicate a known UAC bypass technique [...]

Although the video looks harmless, it is appended with a .NET executable which represents the Orcus RAT.
Click to expand...

Minimalist · Aug 28, 2019

Attackers Target Govt and Financial Orgs With Orcus, Revenge RATs

Multiple malicious campaigns actively targeting government and financial entities around the world have been spotted while backdooring their victims' computers using Revenge and Orcus Remote Access Trojans (RAT).
Click to expand...

https://www.bleepingcomputer.com/ne...t-and-financial-orgs-with-orcus-revenge-rats/

Log in or Sign up

Orcus RAT hidden in Coca-Cola video

guest Guest

Minimalist Registered Member

Log in or Sign up

Orcus RAT hidden in Coca-Cola video

guest Guest

Minimalist Registered Member

Useful Searches