Malware family

OrcusRAT

Profile source: Mallory

C2 tracking

Seven-day C2 activity

Derp observations, rolling seven-day window

1

Jul 15

Observed infrastructure

Last seven days

First activity: Jul 15, 2026
Last activity: Jul 15, 2026
Feed role: C2
Host form: 0 IP / 1 hostnames

Leading locations

FR1

Leading providers

Contabo GmbH1

Infrastructure traits

Hosting 1

Samples

Recent associated samples

884561f17f02de677d1fbec1fb91307c68e770a75baf94802460f5c3a58a15d1

Observed Jul 15, 2026Triage

Reported operators

Threat actors

1 named in public reporting

Following the analysis of the Jennlog loader, SentinelLabs retrieved an additional variant of Jennlog, used to load and run OrcusRAT.

MITRE ATT&CK

OrcusRAT in ATT&CK

3 distinct techniques

Techniques

3 techniques

T1219 Remote Access Tools T1140 Deobfuscate/Decode Files or Information T1027.009 Embedded Payloads

We appreciate you

Derp wouldn't exist without the work these projects do for the security community. We rely on their data sources to improve the quality and depth of what we publish. Thank you, we're genuinely grateful.

adam:ONE Tria.ge IPinfo urlscan.io eCrime.ch Mallory