Extracted

• • Target
    39eb648f6ba77551f5939a22a92679173e1c3a254bcc3164ec8ba5dd7d37070a.bin
  • Size 14.8MB
  • SHA256 39eb648f6ba77551f5939a22a92679173e1c3a254bcc3164ec8ba5dd7d37070a
  • MD5 a30599e521ac621dffeb475ff0629f67
  • SHA1 e4e6c358f6e1634f0c16a9353ad663b341203dfb
  • SHA512 dc6480fe6de257586525f4f2b0087c80c187e3891fd36bd0f9f73ceca058528939f0e47f727ae90f6f75a10bfa131a8921af5c6c75babad3ecc130bdf9dacdeb
  • SSDEEP 98304:TOgBr7pGntaBYyqzw70/F3HO3AqvLiSyD10pCNKYwyrXFE0:Tt/pIKJw03AcLiSyD1Yr
  • TLSH
    T1C7F64987E9B908E8C5AED570C57292237B717C498B2023D72B50F6247F36BD0AEB9714
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdiscoveryoverlordpersistenceprivilege_escalationratspywarestealer

  • Family: Overlord

    Overlord is an open-source Windows RAT written in Golang.

    ratoverlord

  • Drops startup file

  • Executes dropped EXE

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads ssh keys stored on the system

    Tries to access SSH used by SSH programs.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Adds Run key to start application

    persistence
  behavioral1behavioral2