Extracted

• • Target
    agent-windows-amd64-21ae04a2_ole2.msi
  • Size 39.9MB
  • SHA256 800f2968c071709b30a6135482685c3f352fd2a44f235680ea5f665ac2161e7c
  • MD5 8e1090d3ae4e259eb35313e1ca1a3b2b
  • SHA1 aa02eff0d6f181af1e28564231043c0855cbda2f
  • SHA512 86b4c05aac9154448b19502fa63ea75e8047d91e95887c1f90ab63c1de96d17fc3256c0966d4adddf332ef8a2ee1d998c0ecc3e86c9190a410bcff3610f359a8
  • SSDEEP 786432:wueNoGCNu76ybeycg1LeDGDdwgRVv7floYrY17ypzRD5PVBdTj:wHoGaujeycg1LA6T7toYrQ7yp9tVLj
  • TLSH
    T1679733CBE9151EA3F10BC83EBD2B55998309CE0987B045449B3E708BCEBD9B05C95B76
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  overlordpersistenceprivilege_escalationrat

  • Family: Overlord

    Overlord is an open-source Windows RAT written in Golang.

    ratoverlord

  • Event Triggered Execution: Component Object Model Hijacking

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation

  • Loads dropped DLL

  • Registers new Windows logon scripts automatically executed at logon.

    persistence

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2