Extracted

• • Target
    Tokyo Plan/Tokyo-Uni2_password_protected.pdf
  • Size 50KB
  • SHA256 d3d0328f1d6c577595982abea940e29bdc6ab9bdada2e7de38458d97f91e1544
  • MD5 8071919d67bd4d8669056fdc2f0435b4
  • SHA1 18b8b34b5dc6aef8d8e433082aef0445d3d1a763
  • SHA512 6debdcd59694352346acc3e74c04680ef81932036872048c71b3470fa38dd452d7f668540780468dc067255f4dab93a50868493c500fb4c1ada583c5316a2d23
  • SSDEEP 768:+PvQ/h7OStu17LiU8aNKzzcCejtNa306Ejfzw2xzsrFlMLSWhpzd:uvQ/xQVicK1Erdzsplvqpx
  • TLSH
    T14A33AF22A988E85DF447D7CAD72C374CC96CF7135AC430D628AC1C46E48EC59FA266D6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  adwarediscoveryspywarepersistenceransomware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2
• • Target
    Tokyo Plan/Tokyo-Uni_password_protected.pdf
  • Size 32KB
  • SHA256 a832ed6e43b413e5abfed19a5da551a41d70656de4f262351b07f1364bda1223
  • MD5 a6326f8890f8276bde3cfde23b6fbb8f
  • SHA1 870707bcdf458039c7ec8ca5542135aa3ae5fa8c
  • SHA512 317760c5d20bee755f26530ad0f204403746a483338c57a4cbf2c49c286316b519f4d2f2c394d43d8c03152878efe37ab0e7dc1a2f9a94c633fa9a7621cda8ca
  • SSDEEP 768:0vhpDYSLef3Kxug9S5CZQkahZleRXfrBCX9YtiDHb4SpM:uef6ogaJZIBOKtiDHDi
  • TLSH
    T1FDE2D018F216BD9DE1028A00BEAD319596BEF16289C636C31439F20874DC654DF667EF
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  8^/10

  adwarediscoveryspywarepersistenceransomware

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral3behavioral4
• • Target
    python314.dll
  • Size 9.1MB
  • SHA256 470a1588827c3df5200e4b9749a2ec99c2cec292f7da88adde480b0115783762
  • MD5 8887d167b4db626a487e7a4a360577eb
  • SHA1 2912e2eb8ce2398191c22f14e82b59783ce15bdc
  • SHA512 9adc3ae959b03e2ce3670c26d4c5286db3e3d7198860341ba79c75098519f0de12bce53947bd280eee4ef37a9635dc7b43cb76e1e6ae0977fd1067ae9fa392dd
  • SSDEEP 196608:E4LfY4gwar5fIxo94EaaUVl8+D+tGHCEJNxGapwWm9Y:7LAQxM4Erl+D+Ai5cXa
  • TLSH
    T1D8A6330FBBF378D5DD2E46B0A0576A5675937EC7374C098E5349038B1E82F80CDAA962
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryoverlordpersistencerat

  • Family: Overlord

    Overlord is an open-source Windows RAT written in Golang.

    ratoverlord

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral5behavioral6
• • Target
    pythonw.exe
  • Size 102KB
  • SHA256 4cf4ba3c64c5ac896a319bd0ebbf0768be14d42e48fc14702abe23810a359646
  • MD5 74d4268d16116b148e6e32d9b44101d8
  • SHA1 fc094383ec670f83ab81930070aed6e547025147
  • SHA512 b7723a9f0632516b33e6d28d01b4f35ebf761f8bdc3c4554331bb0f1338890ff768a51d76a9929d60b6cac6b87404f6352023d753714a2ca5580e3a1ccd10756
  • SSDEEP 1536:1Z17CIxHHWMpdPa5wiE21M8kJIGFvb1Cwv/84smyvcvR9pfIkII:1ZFBwMpdCq/IM8uIGfV/84sfa
  • TLSH
    T18FA30841E62DBCCDE548D4314A75D4F26E24ED327580A51EB7F37F0628712A3FA0A93A
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryoverlordpersistencerat

  • Family: Overlord

    Overlord is an open-source Windows RAT written in Golang.

    ratoverlord

  • Adds Run key to start application

    persistence
  behavioral7behavioral8
• • Target
    Tokyo Plan/password.txt.lnk
  • Size 675B
  • SHA256 0d45be532d26b03763f10e468922fc3744747028095a3bf91acbf16b509ea881
  • MD5 35307f38beed4f62e372fefe5075b5dd
  • SHA1 16e73ada87776ebcb225eb393214209f12050745
  • SHA512 3a9082a6ac306077f035e6606bbc305e4d6aceef10ff89ebd9669e694df06451e7b7c445af5e8100013329be80c37748eaf0f6d0a2f74be058f6db23b763597a
  • TLSH
    T19701460A29D92720E371CA364633AB318675B9C2DD33C7BD45801ECD4851680B42AE2F
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  defense_evasiondiscoveryoverlordpersistencerat

  • Family: Overlord

    Overlord is an open-source Windows RAT written in Golang.

    ratoverlord

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Loads dropped DLL

  • Adds Run key to start application

    persistence
  behavioral10behavioral9