overlord | 2026-07-30_29a70138e7d93e97557a8278fa0d105e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

Sharing

Copy URL Twitter E-mail

General

Target
2026-07-30_29a70138e7d93e97557a8278fa0d105e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
Size 15.4MB
Sample260730-htmcysde34
SHA256 e4005adb8109e4a490d1e83e6e29360106fbfd1586230657eb1f1f42004c6d5f
MD5 29a70138e7d93e97557a8278fa0d105e
SHA1 512d60e3731b0c73044ac7e4e9f130e1f8d15616
SHA512 450b53cc6e491e1f3a061ffd76cd1b8cd2d545b95089943e6cd64267b71f45ced9e2a12f030a35f77f5ae96efda74ad309f47c1e76ae29e14f6ce051e235a247
SSDEEP 98304:b6VO/ADPOfnBLl+0hpA944ZqwXdzD7VNU+p0pf6VDGMBiWQE:OUojORhS9zXdzD7vfGf6VaU
TLSH
T1B4F64947F9A609A9C0ADC531C5769223BB713C495F3523D72F60B6342F36BD0AABA740
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat overlord

Malware Config

Signatures

Family: Overlord
Overlord is an open-source Windows RAT written in Golang.
rat overlord

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-07-30_29a70138e7d93e97557a8278fa0d105e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

File Explorer

2026-07-30_29a70138e7d93e97557a8278fa0d105e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

.exe 15.4MB

2026-07-30_29a70138e7d93e97557a8278fa0d105e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

IMPHASH ed8b780a3ce7ca4aba78a21f6bc3d4e0
SHA256 e4005adb8109e4a490d1e83e6e29360106fbfd1586230657eb1f1f42004c6d5f
MD5 29a70138e7d93e97557a8278fa0d105e
SHA1 512d60e3731b0c73044ac7e4e9f130e1f8d15616
SHA512 450b53cc6e491e1f3a061ffd76cd1b8cd2d545b95089943e6cd64267b71f45ced9e2a12f030a35f77f5ae96efda74ad309f47c1e76ae29e14f6ce051e235a247
SSDEEP 98304:b6VO/ADPOfnBLl+0hpA944ZqwXdzD7VNU+p0pf6VDGMBiWQE:OUojORhS9zXdzD7vfGf6VaU
TLSH
T1B4F64947F9A609A9C0ADC531C5769223BB713C495F3523D72F60B6342F36BD0AABA740
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

561280

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

7.1MB

Virtual Size

7.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

7.5MB

Virtual Size

7.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

529KB

Virtual Size

33.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

160KB

Virtual Size

164KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

4KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

155KB

Virtual Size

156KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

4KB

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

2026-07-30_29a70138e7d93e97557a8278fa0d105e_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch

kernel32

generic