Extracted

• • Target
    2026-07-07_640a887a6e4f7795950ec5346691275e_agent-tesla_amadey_icedid_luca-stealer_njrat
  • Size 1.1MB
  • SHA256 b7a31229c5ef598485caa294874210185301126b8cf2f2354da61ef2aabc58ca
  • MD5 640a887a6e4f7795950ec5346691275e
  • SHA1 13346ea020a244fe2477eae74647fceedfb92029
  • SHA512 68ef935041be5c15ccab3ca34fdfd9686d0adf7b004c7997b681e8e7fe413fbd39911f163fad53b2327024a517873d6ceb2a75cca08d168e9aac3b4a9958ae82
  • SSDEEP 24576:GCZGvW0tK4jReYSTQ+zYAGRw5bUkGDjkNrC4H4444Cke:N1H4jR2TYrQbDTrC4H4444Ck
  • TLSH
    T1B4356B0533A441EDFEABE5768B13C617C7B278450237961F06A06A766F33BB16A2F311
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryoverlordpersistenceratadwareransomwarespyware

  • Family: Overlord

    Overlord is an open-source Windows RAT written in Golang.

    ratoverlord

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs.

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  behavioral1behavioral2