overlord | cf01403fe738b35b6e643cc80adf4675dfc76f73b9040e4bebbc3ab1cc3fca49

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 02:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-22_10a3f53083d03a894e8dfbc5e48f4606_amadey_elex_luca-stealer_lynx_njrat.exe
Size 11.9MB
Sample260723-cfes3acp7s
SHA256 cf01403fe738b35b6e643cc80adf4675dfc76f73b9040e4bebbc3ab1cc3fca49
MD5 10a3f53083d03a894e8dfbc5e48f4606
SHA1 52af256d6412f60bc03cb9341085208a70e310de
SHA512 7e7169ef3efe679f8d15bc21b6d921aa20aef7aa30c7715a3950da84dc43c2b8bfe9cd45b03763fef7c6af0eea65953afe9ad952c97a7e2d5b0abb09cded5557
SSDEEP 196608:rTRx3ARNh6JznKj9KIb449mE7f3Aynzc6ywmjCKpdu3AkKg1FtFRPubXpvf2zNKD:rTnpznKj9dEQLA02Fp0zFtLujZ2zY
TLSH
T131C6339EF4DA46FCFF8A283D4414DA1396ABF8F60FF44997334865234B609C85608A5F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery overlord rat

Malware Config

Extracted

Family

overlord

45.94.31.227:5173

Signatures

Family: Overlord
Overlord is an open-source Windows RAT written in Golang.
rat overlord

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
behavioral2/files/0x0009000000011374-3.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Executes dropped EXE 1 IoCs

pid	Process
2800	temp_0E599C07.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-22_10a3f53083d03a894e8dfbc5e48f4606_amadey_elex_luca-stealer_lynx_njrat.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	temp_0E599C07.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	temp_0E599C07.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5416 wrote to memory of 2800	5416	2026-07-22_10a3f53083d03a894e8dfbc5e48f4606_amadey_elex_luca-stealer_lynx_njrat.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-22_10a3f53083d03a894e8dfbc5e48f4606_amadey_elex_luca-stealer_lynx_njrat.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-22_10a3f53083d03a894e8dfbc5e48f4606_amadey_elex_luca-stealer_lynx_njrat.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5416
- C:\Users\Admin\AppData\Local\Temp\temp_0E599C07.exe
  "C:\Users\Admin\AppData\Local\Temp\\temp_0E599C07.exe"
  2⤵
  - Executes dropped EXE
  - Checks processor information in registry
  PID:2800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

temp_0E599C07.exe

Path C:\Users\Admin\AppData\Local\Temp\temp_0E599C07.exe
Size 11.8MB
SHA256 f53bff7c34d388860328642a690078052b832afdd7348eaf48baea992ded480b
MD5 e17d9a680fbe351a7fd548364a8cdd1f
SHA1 1d7d655ca3f0933ae987cd17fb43a1135c0a83cb
SHA512 64ccd653d85871a3b2fe0b6a7e9dd5644ec3e36262913114b3440a34da454573a9a79dd011c1d2ed892373574ed2a6b0f69523313bd191b2ac1375d2d0fb4b93
SSDEEP 98304:uUfIjDQaxgk7F9tXg5CpDRNHwHQoPf/7GBootEB:zwrboCpDRlL6/7GBCB
TLSH
T1B1C63857E9A515E5C4ADC230C5769223BB713C898B3123D72F60B6286F77BD0AEB9700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download