Extracted

• • Target
    2026-07-12_8bfe56e5f74a4a60999b9a0b1d5c128a_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
  • Size 11.5MB
  • SHA256 9ee5fdb06b196b17e2b6097ec044ada5416947609c2baa52e2d05b1caece41f0
  • MD5 8bfe56e5f74a4a60999b9a0b1d5c128a
  • SHA1 b35a41e62e682303f485bbd9c8587f15b724a28a
  • SHA512 ff2cab9d00ffa5dd54e730d950fd46106da8c6627d6c4407a631737c36bb7f79d998c7406300ce62312df4ff356fa459187f02af1b259e78140fa414da08802b
  • SSDEEP 98304:vhhfl2UnJCYYEoThD2aUhzP+ypobTYDmrEn2klENiEP:vv4UnA7y9PRpobTYDm4t+
  • TLSH
    T13FC6495BE86915E8C0ADD534C97692237BB1BC481B3023D72F90B6386F36BD0ADB9744
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionoverlordpersistencerat

  • Family: Overlord

    Overlord is an open-source Windows RAT written in Golang.

    ratoverlord
  • Custom signature

    Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2