overlord | agent-windows-amd64-bf2bf385[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
agent-windows-amd64-bf2bf385.exe
Size 12.3MB
Sample260714-xm2avset3t
SHA256 5b6c218e9d4f58590340ca3fb61cad1a4139a17621876b7b65b60cd6da04a5a0
MD5 5fcd2ee28e74bdc1696cf069ee0b8d6f
SHA1 7bceefb3cfd5b40b2151921a8e8e85db167940b8
SHA512 9e0a284441ed1a12a0902264a12878fb07d764bb4838d4785eafdd8e6e7a216730a83e6442b25ae5e7ec96ea68a39ebd6bc2f321651f20e2b86d7828bfadbdbb
SSDEEP 98304:rlYVCyWBUuZ6c9TYMbQQKmrF3vEs469XLUUs2R/DdiHcMJ3Yf6T2:raTWBbf8QKmrpseDdKdw
TLSH
T1A0D64947ED6A09E8C4ADD530C57692637B713C885F2123D72BA0B6742F72BE06EB9344
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat overlord

Malware Config

Extracted

Family

overlord

92.119.165.248:24356

Signatures

Family: Overlord
Overlord is an open-source Windows RAT written in Golang.
rat overlord

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
agent-windows-amd64-bf2bf385.exe

File Explorer

agent-windows-amd64-bf2bf385.exe

.exe 12.3MB

agent-windows-amd64-bf2bf385.exe

IMPHASH e35353effe7047db8af5e79efb1cfdeb
SHA256 5b6c218e9d4f58590340ca3fb61cad1a4139a17621876b7b65b60cd6da04a5a0
MD5 5fcd2ee28e74bdc1696cf069ee0b8d6f
SHA1 7bceefb3cfd5b40b2151921a8e8e85db167940b8
SHA512 9e0a284441ed1a12a0902264a12878fb07d764bb4838d4785eafdd8e6e7a216730a83e6442b25ae5e7ec96ea68a39ebd6bc2f321651f20e2b86d7828bfadbdbb
SSDEEP 98304:rlYVCyWBUuZ6c9TYMbQQKmrF3vEs469XLUUs2R/DdiHcMJ3Yf6T2:raTWBbf8QKmrpseDdKdw
TLSH
T1A0D64947ED6A09E8C4ADD530C57692637B713C885F2123D72BA0B6742F72BE06EB9344
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5296

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

d3d11

D3D11CreateDevice

kernel32

AddVectoredContinueHandler AddVectoredExceptionHandler CloseHandle CreateEventA CreateFileA CreateFileW CreateIoCompletionPort CreateSemaphoreA CreateThread CreateWaitableTimerExW DeleteCriticalSection DuplicateHandle EnterCriticalSection ExitProcess FreeEnvironmentStringsW FreeLibrary GetConsoleMode GetCurrentThreadId GetEnvironmentStringsW GetErrorMode GetFileInformationByHandle GetLastError GetProcAddress GetProcessAffinityMask GetQueuedCompletionStatusEx GetStartupInfoA GetStdHandle GetSystemDirectoryA GetSystemInfo GetThreadContext InitializeCriticalSection IsDBCSLeadByteEx LeaveCriticalSection LoadLibraryA LoadLibraryExW MultiByteToWideChar PostQueuedCompletionStatus QueryPerformanceCounter QueryPerformanceFrequency RaiseFailFastException ReadFile ReleaseSemaphore ResetEvent ResumeThread RtlLookupFunctionEntry RtlVirtualUnwind SetConsoleCtrlHandler SetErrorMode SetEvent SetProcessPriorityBoost SetThreadContext SetThreadPriority SetUnhandledExceptionFilter SetWaitableTimer Sleep SuspendThread SwitchToThread TlsAlloc TlsGetValue VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WerGetFlags WerSetFlags WideCharToMultiByte WriteConsoleW WriteFile __C_specific_handler

msvcrt

___lc_codepage_func ___mb_cur_max_func __initenv __iob_func __getmainargs __set_app_type _acmdln __setusermatherr _amsg_exit _assert _cexit _commode _fmode _errno memcpy memmove memset _initterm _lock _onexit _stricmp _unlock _wfopen abort calloc exit fclose fopen fprintf fputc fread free fseek ftell fwrite localeconv malloc realloc signal strerror strlen strncmp strncpy vfprintf wcslen

Name

.text

Size

5.9MB

Virtual Size

5.9MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

471KB

Virtual Size

471KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

5.7MB

Virtual Size

5.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

141KB

Virtual Size

141KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

19KB

Virtual Size

18KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

32.4MB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

124B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

4KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

96B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

116KB

Virtual Size

116KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Signatures

File Explorer

agent-windows-amd64-bf2bf385.exe

d3d11

kernel32

msvcrt

generic