Overview

overview

10

Static

static

5

ecosj.exe

windows10-2004-x64

10

ecosj.exe

windows11-ltsc_2024-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    ecosj.exe
  • Size 3.2MB
  • Sample260626-pfgzmsa15w
  • SHA256 ffb285a105f3c2860fd8f1f2ad54642d4d1c34b7ab457418dea9e4e2053fa1ef
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
overlordexecutionratupx

Malware Config

Extracted

Family

  • overlord

C2

  • https://119.1.170.243:5577/server.txt,https://153.35.130.242:8950/server.txt,https://58.213.117.66:8443/server.txt,https://222.79.207.170:7443/server.txt,https://60.255.197.60:20443/server.txt,https://58.213.117.66:4431/server.txt

Targets

    • Target
      ecosj.exe
    • Size 3.2MB
    • SHA256 ffb285a105f3c2860fd8f1f2ad54642d4d1c34b7ab457418dea9e4e2053fa1ef
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    executionoverlordratupx

    • Family: Overlord

      Overlord is an open-source Windows RAT written in Golang.

      ratoverlord

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    • UPX packed file

      Detects executables packed with UPX/modified UPX open source packer.

      upx
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks