Overview

overview

10

Static

static

1

09c1d5c3-1...om.ps1

windows10-2004-x64

10

09c1d5c3-1...om.ps1

windows11-ltsc_2024-x64

8

Sharing

Copy URL Twitter E-mail

General

  • Target
    09c1d5c3-1a6e-4c05-8e4e-eff75c6b5dd6.filesusr.com.ps1
  • Size 11KB
  • Sample260626-l92pcsav4t
  • SHA256 0c627ab6a8d28441c206e17807ded824d2148c3424c6a13bd7455e0c2d2d039d
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
overlordadwarediscoveryexecutionpersistenceratspywareupx

Malware Config

Extracted

Family

  • overlord

C2

  • icro-soft.com:5173

Targets

    • Target
      09c1d5c3-1a6e-4c05-8e4e-eff75c6b5dd6.filesusr.com.ps1
    • Size 11KB
    • SHA256 0c627ab6a8d28441c206e17807ded824d2148c3424c6a13bd7455e0c2d2d039d
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    adwarediscoveryexecutionoverlordpersistenceratspywareupx

    • Family: Overlord

      Overlord is an open-source Windows RAT written in Golang.

      ratoverlord

    • Badlisted process makes network request

      Network request originating from process or tool commonly abused by malware.

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks