Top Tweets for #OrcusRAT
+ There is also comms to 91.92.240[.]197:9000.
If we search the above web paths, we find samples related to #OrcusRAT, and if we pivot on the certificate (7b944956977315563339165a344e416c0c0688f22be8f7f389edff660f94aa93) of the service on port 9000, we also arrive at a confirmed C2 of Orcus (91.92.240[.]204), possibly the same threat.
![1ZRR4H's tweet photo. + There is also comms to 91.92.240[.]197:9000.
If we search the above web paths, we find samples related to #OrcusRAT, and if we pivot on the certificate (7b944956977315563339165a344e416c0c0688f22be8f7f389edff660f94aa93) of the service on port 9000, we also arrive at a confirmed C2 of Orcus (91.92.240[.]204), possibly the same threat.](https://pbs.twimg.com/media/HCcJEnWXIAAn7Sr.jpg)
![skocherhan's tweet photo. 202[.]137[.]123[.]210:10134
AS38553 DC Tech Micro Services Inc 🇵🇭
#OrcusRAT @abuse_ch https://t.co/2X8DJlRThD](https://pbs.twimg.com/media/HBhlcLmX0AA51FI.jpg)
#OrcusRat
👇
144.31.189.]163
👇
https://t.co/IwNenEUAQj
![JAMESWT_WT's tweet photo. #OrcusRat
👇
144.31.189.]163
👇
https://t.co/IwNenEUAQj https://t.co/yogL7LCbCM](https://pbs.twimg.com/media/G32AqO6X0AApOQD.png)
![JAMESWT_WT's tweet photo. #OrcusRat
👇
144.31.189.]163
👇
https://t.co/IwNenEUAQj https://t.co/yogL7LCbCM](https://pbs.twimg.com/media/G32Apk3XQAA5Tli.png)
#OrcusRAT is a #backdoor which is notorious for its ability to load custom-developed plugins. This makes it a persistent threat which keeps resurfacing. Don't become a victim, deploy our public #YARArules. https://t.co/B7SxBoRDet
Tried hunting OrcusRAT Servers ?
Try using this search term "OrcusServerCertificate" and looking at the certificates.
Shodan: 0 results
Censys: 7 results
FOFA: 20 results
ZoomEye: 9 results
#OrcusRAT #threathunting #malware #ThreatIntelligence #ThreatIntel
![sicehice's tweet photo. #opendir hosting builders for #OrcusRAT #QuasarRAT #Remcos #WarzoneRAT
185.238.3[.]205 https://t.co/jvOWJStdcs](https://pbs.twimg.com/media/Fr_O7IcWAAImf6M.jpg)
The @anyrun_app team provided a technical #malware analysis #OrcusRAT, a trojan that allows attackers to create plugins and offers a robust core feature set.
#CyberSecurity #InfoSec https://t.co/9hXBYbKga5
109.206.241[.81/htdocs/ #opendir 465 samples
#AsyncRAT #njRAT #Formbook #RemcosRAT #AgentTesla #RecordBreaker #NetWire #orcusrat #StormKitty #RedLineStealer #MassLogger #vjw0rm
#AveMariaRAT #a310Logger #QuasarRAT etc
👇
https://t.co/hjZf2rYL6i
👇Backup👇
https://t.co/KHpeLePqJi
#MITRE ATT&CK for #Infostealers exploiting #Log4Shell
#OrcusRAT #NanocoreRAT #njRAT
https://t.co/L7pemH7mDI
MS Excel malware analysis https://t.co/QkjpJ4QtUE #OrcusRat
#signed "ABBYMAJUTA LTD LIMITED"
Collections Samples
Including #RedLineStealer Samples
https://t.co/AkQtEI01An
https://t.co/4BGVpjAv9f
Md5 HashList
https://t.co/y5GU8NgFeO
H/T @malwrhunterteam
cc @felixw3000 @verovaleros @58_158_177_102
cc2 @IntezerLabs @arieitan #orcusrat ?
#OrcusRat #Rat First Submission 2020-10-18 14:44:57
Loader
https://t.co/siLNVDUSXT
Payload
https://t.co/20WHhKt8HL
Url @zbetcheckin
https://t.co/u3yUk5NevD
C2 88.123.12.[74
@malwrhunterteam @verovaleros @cyb3rops @Arkbird_SOLG @sugimu_sec
@BlackonIntel @anyrun_app @malwrhunterteam @James_inthe_box @makflwana nf2.exe and nf3.exe are #Orcusrat
#tinydownloader 758da348a7d54140ab9f9aa582829a62
dowloads multiple payload from dropbox
#ORCUSRAT a7ba8729ae724371b304787a608476c2
#njRAT dc31f026260847deff5702bd4b2708f3
#Quasar 767fa7872bbbce72ea22da4bd419955
#AsyncRAT 62dce44367e7d753b0ce8e5ac079b98f
Back in 2016, I published the first report on the capabilities of the malware which also mentioned two main individuals who were behind #OrcusRAT as opposed to only one earlier reported by Brian Krebs. Report here- https://t.co/3GDFK5a7iE
Really nice to see Canadian LEAs taking action against the individuals who created and sold #OrcusRAT to other criminals, enabling them to target innocent victims globally and profit from the attacks. We have tracked a staggering number of attacks which used OrcusRAT since 2016.
#CRTC’s Chief Compliance and Enforcement Officer issued a penalty of $100,000 to John Paul Revesz and Vincent Leo Griebel, partners operating under the business name Orcus Technologies, for distributing malware #fightspam https://t.co/kgSicYRSCx
Last Seen Hashtags on Sotwe
Most Popular Users
Elon Musk 
@elonmusk
241.5M followers
Barack Obama
@barackobama
119M followers
Cristiano Ronaldo
@cristiano
113.9M followers
Donald J. Trump
@realdonaldtrump
111.8M followers
Narendra Modi
@narendramodi
107.2M followers
Rihanna
@rihanna
98.6M followers
NASA
@nasa
92.4M followers
Justin Bieber
@justinbieber
91.8M followers
KATY PERRY
@katyperry
89.7M followers
Taylor Swift
@taylorswift13
83.7M followers
Lady Gaga
@ladygaga
75.1M followers
Virat Kohli
@imvkohli
72.9M followers
Kim Kardashian
@kimkardashian
70.8M followers
YouTube
@youtube
68.8M followers
Neymar Jr
@neymarjr
65.9M followers
Bill Gates
@billgates
64.9M followers
Selena Gomez
@selenagomez
62.8M followers
The Ellen Show
@theellenshow
62.3M followers
CNN
@cnn
61.8M followers
X
@x
60.7M followers