overlord | agent-windows-amd64-41ee793c[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
agent-windows-amd64-41ee793c.exe
Size 12.3MB
Sample260708-mvyvlaev2z
SHA256 5e6d1d186dedaf40be056aa312f4efcc55607b65ff6af94dd81f5ab89ccdd5f1
MD5 aee7c664c22b0228f5b09e14e38d2d5d
SHA1 844f8ffc1ca1f0c5d96c1f9ace470231369ef486
SHA512 095048c39897a12b3ed8f6385196505d331f7eb9dca330c3e86a86098afcec56554f83f60a1528d58b76a469af30b891f813add2bdbdea4357282e6cee823c09
SSDEEP 98304:Sl7GHqtBHGB6E17YmbQ4KqrF3QE/s69XLUUs2R/DdiHcMJ3Yf6T2:S4KtBcF84KqrppxDdKdw
TLSH
T1B9D64947ED6A09E9C4ADD530C57692637B713C885F2123D72B60B6782F72BE06EB9304
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat overlord

Malware Config

Extracted

Family

overlord

92.119.165.248:24356

Signatures

Family: Overlord
Overlord is an open-source Windows RAT written in Golang.
rat overlord

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
agent-windows-amd64-41ee793c.exe

File Explorer

agent-windows-amd64-41ee793c.exe

.exe 12.3MB

agent-windows-amd64-41ee793c.exe

IMPHASH e35353effe7047db8af5e79efb1cfdeb
SHA256 5e6d1d186dedaf40be056aa312f4efcc55607b65ff6af94dd81f5ab89ccdd5f1
MD5 aee7c664c22b0228f5b09e14e38d2d5d
SHA1 844f8ffc1ca1f0c5d96c1f9ace470231369ef486
SHA512 095048c39897a12b3ed8f6385196505d331f7eb9dca330c3e86a86098afcec56554f83f60a1528d58b76a469af30b891f813add2bdbdea4357282e6cee823c09
SSDEEP 98304:Sl7GHqtBHGB6E17YmbQ4KqrF3QE/s69XLUUs2R/DdiHcMJ3Yf6T2:S4KtBcF84KqrppxDdKdw
TLSH
T1B9D64947ED6A09E9C4ADD530C57692637B713C885F2123D72B60B6782F72BE06EB9304
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5296

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

d3d11

D3D11CreateDevice

kernel32

AddVectoredContinueHandler AddVectoredExceptionHandler CloseHandle CreateEventA CreateFileA CreateFileW CreateIoCompletionPort CreateSemaphoreA CreateThread CreateWaitableTimerExW DeleteCriticalSection DuplicateHandle EnterCriticalSection ExitProcess FreeEnvironmentStringsW FreeLibrary GetConsoleMode GetCurrentThreadId GetEnvironmentStringsW GetErrorMode GetFileInformationByHandle GetLastError GetProcAddress GetProcessAffinityMask GetQueuedCompletionStatusEx GetStartupInfoA GetStdHandle GetSystemDirectoryA GetSystemInfo GetThreadContext InitializeCriticalSection IsDBCSLeadByteEx LeaveCriticalSection LoadLibraryA LoadLibraryExW MultiByteToWideChar PostQueuedCompletionStatus QueryPerformanceCounter QueryPerformanceFrequency RaiseFailFastException ReadFile ReleaseSemaphore ResetEvent ResumeThread RtlLookupFunctionEntry RtlVirtualUnwind SetConsoleCtrlHandler SetErrorMode SetEvent SetProcessPriorityBoost SetThreadContext SetThreadPriority SetUnhandledExceptionFilter SetWaitableTimer Sleep SuspendThread SwitchToThread TlsAlloc TlsGetValue VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WerGetFlags WerSetFlags WideCharToMultiByte WriteConsoleW WriteFile __C_specific_handler

msvcrt

___lc_codepage_func ___mb_cur_max_func __initenv __iob_func __getmainargs __set_app_type _acmdln __setusermatherr _amsg_exit _assert _cexit _commode _fmode _errno memcpy memmove memset _initterm _lock _onexit _stricmp _unlock _wfopen abort calloc exit fclose fopen fprintf fputc fread free fseek ftell fwrite localeconv malloc realloc signal strerror strlen strncmp strncpy vfprintf wcslen

Name

.text

Size

5.9MB

Virtual Size

5.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

471KB

Virtual Size

471KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

5.7MB

Virtual Size

5.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

141KB

Virtual Size

141KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

32.4MB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

124B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

96B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

116KB

Virtual Size

116KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

agent-windows-amd64-41ee793c.exe

d3d11

kernel32

msvcrt

generic