OverlordShell[.]exe

General

Target
OverlordShell.exe
Size 8.1MB
Sample260624-xzacxae16j
SHA256 246f1eb23d60a252a78cf07bc7da0f59d8583d1b791eb4dd4f29f9ac9391c79d
MD5 541af76cc085d8ef52d8af8f21d68482
SHA1 f9f20bc1c02a1dd779ae3b02948b512cc4e00b96
SHA512 3aefba9ff21c6b273bde379d70214b2cffa814e2c8d162c07fabb5d90899596c66825c37007139648b7ed1a900bcbf23df8fdff401cd8070989be2cf6efdc122
SSDEEP 196608:rX4kUe/HmrNqxJnW8V1k7V6KnB3axdkGzgT+PKZ8Z4DimP:lUhrNeWMg0oB3axdk9T+DZ4emP
TLSH
T15A8633471FD80616EE7B413BE3368CDC84458324BF11FB4E4BC9D3A7608F994ABA2695
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
OverlordShell.exe

File Explorer

OverlordShell.exe

.exe 8.1MB

OverlordShell.exe

IMPHASH 3cf6fd0e52df79a1ddbaf09fd333bd49
SHA256 246f1eb23d60a252a78cf07bc7da0f59d8583d1b791eb4dd4f29f9ac9391c79d
MD5 541af76cc085d8ef52d8af8f21d68482
SHA1 f9f20bc1c02a1dd779ae3b02948b512cc4e00b96
SHA512 3aefba9ff21c6b273bde379d70214b2cffa814e2c8d162c07fabb5d90899596c66825c37007139648b7ed1a900bcbf23df8fdff401cd8070989be2cf6efdc122
SSDEEP 196608:rX4kUe/HmrNqxJnW8V1k7V6KnB3axdkGzgT+PKZ8Z4DimP:lUhrNeWMg0oB3axdk9T+DZ4emP
TLSH
T15A8633471FD80616EE7B413BE3368CDC84458324BF11FB4E4BC9D3A7608F994ABA2695
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

6352

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\olika\Downloads\snagg\OverlordShell\x64\Release\OverlordShell.pdb

kernel32

GetModuleFileNameW CreateMutexW GetModuleHandleA MultiByteToWideChar Sleep GetLastError VirtualAlloc CloseHandle LoadResource FindResourceW GetProcAddress GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId GetCurrentProcess VirtualProtect LockResource SizeofResource QueryPerformanceCounter SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW InitializeSListHead

user32

EnumWindows

advapi32

RegSetValueExW RegOpenKeyExW RegCloseKey

vcruntime140

memcpy _CxxThrowException __std_exception_destroy __std_exception_copy __C_specific_handler __current_exception __current_exception_context

api-ms-win-crt-runtime-l1-1-0

exit _initterm_e _initialize_onexit_table _cexit _crt_atexit terminate _initterm _exit _get_narrow_winmain_command_line _c_exit _register_onexit_function _initialize_narrow_environment _register_thread_local_exe_atexit_callback _set_app_type _seh_filter_exe _configure_narrow_argv

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free _callnewh malloc _set_new_mode

api-ms-win-crt-string-l1-1-0

wcslen

Sharing