Extracted

• • Target
    https://cdn.discordapp.com/attachments/1518253681391173642/1531819382593032404/agent-windows-amd64-ccf9a769.exe?ex=6a6a9978&is=6a6947f8&hm=00e202124fe8e80f2984e352a7181f705ff89bdd7a3bf493e1b6f4c242ccd16f&

  Score

  10^/10

  discoveryoverlordratpersistenceransomwareadwaredefense_evasionspyware

  • Family: Overlord

    Overlord is an open-source Windows RAT written in Golang.

    ratoverlord

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Downloads MZ/PE file

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2behavioral3