Overview

overview

10

Static

static

10

agent-wind...48.exe

windows10-2004-x64

10

agent-wind...48.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    88s
  • max time network
    90s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260617-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    22/06/2026, 21:16

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    agent-windows-amd64-840a8c48.exe
  • Size 21.9MB
  • Sample260622-z4ybmsgv9r
  • SHA256 bbd91e4e255064e616d33504696530c1ac83086418e7cb7e81318c2caec8d945
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
overlordrat

Malware Config

Extracted

Family

  • overlord

C2

  • 31.76.30.236:1337

Signatures

  • Family: Overlord

    Overlord is an open-source Windows RAT written in Golang.

    ratoverlord
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\agent-windows-amd64-840a8c48.exe
    "C:\Users\Admin\AppData\Local\Temp\agent-windows-amd64-840a8c48.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3852

Network

        MITRE ATT&CK Matrix

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/3852-0-0x00007FF7EF920000-0x00007FF7F2E69000-memory.dmp
        Download

        memory/3852-2-0x00007FF7EF920000-0x00007FF7F2E69000-memory.dmp
        Download

        memory/3852-3-0x00007FF7EF920000-0x00007FF7F2E69000-memory.dmp
        Download

        memory/3852-5-0x00007FF7EF920000-0x00007FF7F2E69000-memory.dmp
        Download