Orcus RAT
Aliases: Schnorchel
- First seen
- 2016-01-01 00:00:00
- Malware type
- rat
- Family
- Malware family
- Last IoC activity
- 2026-07-22 00:33:11
- Profile updated
- 2026-07-07 13:46:57
Context
Orcus has been advertised as a Remote Administration Tool (RAT) since early 2016. It has all the features that would be expected from a RAT and probably more. The long list of the commands is documented on their website. But what separates Orcus from the others is its capability to load custom plugins developed by users, as well as plugins that are readily available from the Orcus repository. In addition to that, users can also execute C# and VB.net code on the remote machine in real-time.
Detection coverage
- 1 YARA rules
Detection rules
- EMBEERESEARCH_Win_Orcus_Rat_Simple_Strings_Dec_2023 (yara-rule)
Reports & references
- assets.virustotal.com — 2021Trends (report)
- Broadcom/Symantec — Log4J Vulnerabilities Attacks (report)
- blogs.blackberry.com — Dot Net Stubs Sowing The Seeds Of Discord (report)
- Trend Micro — Ssl Tls Technical Brief (report)
- malpedia.caad.fkie.fraunhofer.de — Win.Orcus Rat (report)
- any.run — Orcus Rat Malware Analysis (report)
- asec.ahnlab.com — 45462 (report)
- researchcenter.paloaltonetworks.com — Unit42 Orcus Birth Of An Unusual Plugin Builder Rat (report)
- Cisco Talos — Rat Ratatouille Revrat Orcus (report)
- blog.fortinet.com — A Peculiar Case Of Orcus Rat Targeting Bitcoin Investors (report)
- krebsonsecurity.com — Canadian Police Raid Orcus Rat Author (report)
- krebsonsecurity.com — Canadian Man Is Author Of Popular Orcus Rat (report)
- canada.ca — Crtc And Rcmp National Division Execute Warrants In Malware Investigation (report)
- blog.checkpoint.com — Protecting Against Winrar Vulnerabilities (report)