overlord | 2026-07-08_ea96eac0a89d9eafd965f9481759cc76_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

General

Target
2026-07-08_ea96eac0a89d9eafd965f9481759cc76_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
Size 20.2MB
Sample260708-t3c2esdx6v
SHA256 9f4fe6ffb29c7b77035aaf88e1f07439938eaa9cf1f3f46e4118ed48fd210191
MD5 ea96eac0a89d9eafd965f9481759cc76
SHA1 2b75ffedd3f4551d83710ba216cac4ecf6fb390a
SHA512 270945fd06d8ed4494bab46c9bef2f001c3ba9db06dd92a69367632aa02ce544c82d04a05532d936de436cebb9302e5949fb1374a42ac26e8ecce9d388679793
SSDEEP 98304:BhFwxD74PG6odtDI59S+sAz+fmihl6AGfsDn1pY+nu7whEjBzV:BcdjM9FsA6D6AGfsDn70wijB
TLSH
T11C272887F96915E8C4ED95318972A2637FB13C894B2023D32B50F6247F36BD0AEB9354
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

upx rat overlord

Malware Config

Extracted

Family

overlord

C2

panel.freetools.lol

Signatures

Family: Overlord
Overlord is an open-source Windows RAT written in Golang.
rat overlord

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

UPX dump on OEP (original entry point) 1 IoCs

resource	yara_rule
sample	UPX

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
sample	upx

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-08_ea96eac0a89d9eafd965f9481759cc76_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

File Explorer

2026-07-08_ea96eac0a89d9eafd965f9481759cc76_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

.exe 20.2MB

2026-07-08_ea96eac0a89d9eafd965f9481759cc76_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

SHA256 9f4fe6ffb29c7b77035aaf88e1f07439938eaa9cf1f3f46e4118ed48fd210191
MD5 ea96eac0a89d9eafd965f9481759cc76
SHA1 2b75ffedd3f4551d83710ba216cac4ecf6fb390a
SHA512 270945fd06d8ed4494bab46c9bef2f001c3ba9db06dd92a69367632aa02ce544c82d04a05532d936de436cebb9302e5949fb1374a42ac26e8ecce9d388679793
SSDEEP 98304:BhFwxD74PG6odtDI59S+sAz+fmihl6AGfsDn1pY+nu7whEjBzV:BcdjM9FsA6D6AGfsDn70wijB
TLSH
T11C272887F96915E8C4ED95318972A2637FB13C894B2023D32B50F6247F36BD0AEB9354
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
UPX dump on OEP (original entry point)
UPX packed file

Detects executables packed with UPX/modified UPX open source packer.

upx
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

49755984

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Sharing