overlord | agent-windows-amd64-a0d16802[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
agent-windows-amd64-a0d16802.exe
Size 21.9MB
Sample260622-1az4tagz21
SHA256 aa369a74ce807a8f8507b30a936782da6d9cd84dd7265525132602582558cea7
MD5 ceec165ef212f5daeb35f6c37d048e63
SHA1 a2b5e25c961e8e86803f03b731e5f8a45817f362
SHA512 bb4a547858b0456b0f1b8889bd2634a949eeac40b7494c110839f2168a12e97ca9ba435f648d47608793857fca91490a419a1b098fe534825df0d93353e5fd63
SSDEEP 196608:KkxnvxblszD1ehjmlgp22cW0g9L4UJDaIWt/pTTNcwwPbpGHZ6:KcxblsNtmHnStIbpG56
TLSH
T166378D07E81819EAC7A891F5C9AF86067378B804172767C72E10F734BDA77D5AE7A340
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat overlord

Malware Config

Extracted

Family

overlord

31.76.30.236:5173

Signatures

Family: Overlord
Overlord is an open-source Windows RAT written in Golang.
rat overlord

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
agent-windows-amd64-a0d16802.exe

File Explorer

agent-windows-amd64-a0d16802.exe

.exe 21.9MB

agent-windows-amd64-a0d16802.exe

IMPHASH e35353effe7047db8af5e79efb1cfdeb
SHA256 aa369a74ce807a8f8507b30a936782da6d9cd84dd7265525132602582558cea7
MD5 ceec165ef212f5daeb35f6c37d048e63
SHA1 a2b5e25c961e8e86803f03b731e5f8a45817f362
SHA512 bb4a547858b0456b0f1b8889bd2634a949eeac40b7494c110839f2168a12e97ca9ba435f648d47608793857fca91490a419a1b098fe534825df0d93353e5fd63
SSDEEP 196608:KkxnvxblszD1ehjmlgp22cW0g9L4UJDaIWt/pTTNcwwPbpGHZ6:KcxblsNtmHnStIbpG56
TLSH
T166378D07E81819EAC7A891F5C9AF86067378B804172767C72E10F734BDA77D5AE7A340
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5328

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDevice

kernel32

AddVectoredContinueHandler AddVectoredExceptionHandler CloseHandle CreateEventA CreateFileA CreateFileW CreateIoCompletionPort CreateSemaphoreA CreateThread CreateWaitableTimerExW DeleteCriticalSection DuplicateHandle EnterCriticalSection ExitProcess FreeEnvironmentStringsW FreeLibrary GetConsoleMode GetCurrentThreadId GetEnvironmentStringsW GetErrorMode GetFileInformationByHandle GetLastError GetProcAddress GetProcessAffinityMask GetQueuedCompletionStatusEx GetStartupInfoA GetStdHandle GetSystemDirectoryA GetSystemInfo GetThreadContext InitializeCriticalSection IsDBCSLeadByteEx LeaveCriticalSection LoadLibraryA LoadLibraryExW MultiByteToWideChar PostQueuedCompletionStatus QueryPerformanceCounter QueryPerformanceFrequency RaiseFailFastException ReadFile ReleaseSemaphore ResetEvent ResumeThread RtlLookupFunctionEntry RtlVirtualUnwind SetConsoleCtrlHandler SetErrorMode SetEvent SetProcessPriorityBoost SetThreadContext SetThreadPriority SetUnhandledExceptionFilter SetWaitableTimer Sleep SuspendThread SwitchToThread TlsAlloc TlsGetValue VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WerGetFlags WerSetFlags WideCharToMultiByte WriteConsoleW WriteFile __C_specific_handler

msvcrt

___lc_codepage_func ___mb_cur_max_func __initenv __iob_func __getmainargs __set_app_type _acmdln __setusermatherr _amsg_exit _assert _cexit _commode _fmode _errno memcpy memmove memset _initterm _lock _onexit _stricmp _unlock _wfopen abort calloc exit fclose fopen fprintf fputc fread free fseek ftell fwrite localeconv malloc realloc signal strerror strlen strncmp strncpy vfprintf wcslen

Name

.text

Size

4.6MB

Virtual Size

4.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

433KB

Virtual Size

433KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

4.4MB

Virtual Size

4.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

123KB

Virtual Size

123KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

32.3MB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

124B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

96B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

88KB

Virtual Size

87KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/19

Size

5.5MB

Virtual Size

5.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/31

Size

29KB

Virtual Size

28KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/45

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/57

Size

650KB

Virtual Size

650KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/70

Size

26KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/81

Size

512B

Virtual Size

24B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/100

Size

76KB

Virtual Size

76KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/112

Size

23KB

Virtual Size

22KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/128

Size

2.5MB

Virtual Size

2.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

/144

Size

587KB

Virtual Size

587KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

agent-windows-amd64-a0d16802.exe

d3d11

kernel32

msvcrt

generic