Extracted

• • Target
    shitty-windows-amd64-aa4b642d (1).bat
  • Size 352B
  • SHA256 57809c5252f85f0f92eaa54a4cbc892ebf2309fab3e68a81907f08fd466c471b
  • MD5 8abe1fd2c12e9235fe0f67b7e7f7c333
  • SHA1 cfc3e6a73baf65130a0cca16b846ba71734913a6
  • SHA512 4603d540aad3824e8f977b80ce340d9bb5484dd6077e531feaf8596a6ac7f920d8162dcb7878f82a4f9bd1f855444227094d3c8436deb88a195ec72a793f9a9e
  • TLSH
    T132E02692E09225785EF2CBC88D741ACB2BAFC0E70785F8DC9124DE08008D11FC396860
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  discoveryexecutionoverlordpersistencerat

  • Family: Overlord

    Overlord is an open-source Windows RAT written in Golang.

    ratoverlord

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Drops startup file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates processes with tasklist

    discovery
  behavioral1behavioral2