Overview

overview

10

Static

static

10

agent-wind...f5.exe

windows10-ltsc_2021-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    agent-windows-amd64-dff08bf5.exe
  • Size 15.5MB
  • Sample260705-169m5aby2p
  • SHA256 b72bfa698149821a6c7a595d7567c2454bd381445cff6ce269a40c4468f9f174
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
overlordexecutionrat

Malware Config

Extracted

Family

  • overlord

C2

  • 212.15.49.149:5173

Targets

    • Target
      agent-windows-amd64-dff08bf5.exe
    • Size 15.5MB
    • SHA256 b72bfa698149821a6c7a595d7567c2454bd381445cff6ce269a40c4468f9f174
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    executionoverlordrat

    • Family: Overlord

      Overlord is an open-source Windows RAT written in Golang.

      ratoverlord

    • Command and Scripting Interpreter: PowerShell

      Run Powershell and hide display window.

      execution

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Enterprise v16

Tasks