overlord | dc58b8416a407d9465b1e3d466d5e49780fb28a3d4772d9a972b27616a5217fb

Analysis

user interaction
yes
max time kernel
24s
max time network
24s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
mrwyxuhvtz.exe
Size 12.8MB
Sample260731-pg53vsfp4t
SHA256 dc58b8416a407d9465b1e3d466d5e49780fb28a3d4772d9a972b27616a5217fb
MD5 48aa82ba8affc175b65b604a1693a89d
SHA1 864b909cb08da1e85da0d50243d8d882a7ca1f18
SHA512 d983233ed6bd43c26c2cbfc459c8812de0997fba3d951400e1f50e6a72c10095e949d0efc62a826db791e58866dddc8659c60ce90503281b926e1264e07a235d
SSDEEP 98304:GjKUElknhYZ9o7fcvjku1Q+iF1R9rMlUER9XLUUsmR+DH9H7E92QRoa0iL6:YnfnhmyNWQ+qxw7EDHVmfRhL
TLSH
T12AD64957E96905E8C4EDD6308576A6237BB17C490F3033D72B60B6282F36BD0AEB9750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

overlord rat

Malware Config

Extracted

Family

overlord

65.87.7.61:5173

Signatures

Family: Overlord
Overlord is an open-source Windows RAT written in Golang.
rat overlord

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	mrwyxuhvtz.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	mrwyxuhvtz.exe

C:\Users\Admin\AppData\Local\Temp\mrwyxuhvtz.exe
"C:\Users\Admin\AppData\Local\Temp\mrwyxuhvtz.exe"
1⤵
- Checks processor information in registry
PID:3168

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3168-0-0x00007FF680080000-0x00007FF682DBA000-memory.dmp

Download