Extracted

• • Target
    Microsoft.Web.WebView2.Core.dll
  • Size 533KB
  • SHA256 c886c3003f208d64839ec3c77c3889ef98a0344439e18aa613e7b199bd04bb2d
  • MD5 36a26a59c3b124c90af32bd87fdc003a
  • SHA1 abea61150aa1aad467c95528ba9fadaf724189e1
  • SHA512 45cea404b0833ddc98077ae859142aa96cefbbddac611511193c637139eec935fa6d50969889a74226ef98afc5da63df4a45ff70fa7cba276b2717503557fba0
  • SSDEEP 12288:r0vEInrpQ322zy+uFKcDzRFNXeA+imQ269pRFZNIEJdIEY0lxPrEIgcvLcglxMwu:YMvH
  • TLSH
    T1B3C4841223FD865AF6F33FB5653412608BF6BDA6B939D74E0698509D0C32B809DA1733
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral1behavioral2
• • Target
    Microsoft.Web.WebView2.WinForms.dll
  • Size 39KB
  • SHA256 ccaf1f9ed1313a7218dd456114a2914f5b0b514b8c00ba90f14e6a7927930c35
  • MD5 823d314a7a7b7433d372d5e0fc9abb76
  • SHA1 125ab38d78a5d3b1f2f315a500908d132a44b1a8
  • SHA512 040db73d0ee1873712cdb93bacadcc0f97f9b2908585e35e96b538ac44a24556498ef7d38263ab6806c3ea8babf7613505d80646933c23a01b63266fac799550
  • SSDEEP 768:rFCniwqfU2Gm0bOVmW0etG7yf8ZDgcEST3p4Jjrjh2jJGSUyauTv1JKia5/Zi/Wk:rI7yf8ZDgcEST3p4JjrjaJGSUyau71Jh
  • TLSH
    T140034A4143AC853BE6EF5FFC95B085621B7ABFC3BA61D7882991B0E91D73390490076B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral3behavioral4
• • Target
    Microsoft.Web.WebView2.Wpf.dll
  • Size 46KB
  • SHA256 5eaaded54cd8f8f08f8f9aa09f6dbb2cd8f76753abbd6524b23aa1d0f52f7d16
  • MD5 d8a961a75b1949ccc43f567ca98a49ed
  • SHA1 1a1237ddb927640fbe58708d61ed8c37e3f9b532
  • SHA512 2923160c82e52a25c03ef931b2dc510fe8e29c37f38e08e87b6159364c18699d31f549077abc02f0135bfa02fc0fd5bdafaecbc8b9b1970a4aa940a6c0a4cb0a
  • SSDEEP 768:UV08pvSZjQIf1jlCPcePUOVw8aDP/ryEH0tBy4JjrD1h2j5hUURGvkq7FKKa5/Bt:z84jQW1jlOzPjw8aDP/ryEH0tBy4Jjra
  • TLSH
    T1392329C047EE8526F5EE1FB470B091191B79BF43BA21F75917C4B0A80A3B3A189543EB
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral5behavioral6
• • Target
    Syron.exe
  • Size 13.7MB
  • SHA256 10ee24f921e3c12fd63bcc4101af3dd4406868de773e95b17a1b05110fe1af1e
  • MD5 4a829c822dbc4e79e6fdbb9cbf37c630
  • SHA1 f309bca93de9f7ba66e84783abfb6f25ccae1618
  • SHA512 e5182d1968a9698f1738dcb0590de4baf29ee550b557efe62b8d35bcbb30a3fdb9f9732644724d4b67b7d7650405e09e17d27b8714f66583896374e49444b2e5
  • SSDEEP 393216:l7gvS/iegQfrmS7Mr/M70bt7CQEf9Bm/Ai/ohn:VgvS/iegQf5f0bB5EfPco
  • TLSH
    T1BDE612A239CCB18EABBBB8AD8C3EFFD15470B087F31358912B98454947C2EBB1555817
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasionexecutionoverlordratspywaretrojan

  • Detects Overlord RAT

  • Family: Overlord

    Overlord is an open-source Windows RAT written in Golang.

    ratoverlord

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  behavioral7behavioral8
• • Target
    WebView2Loader.dll
  • Size 114KB
  • SHA256 9915bfd98e275a5147de65029e0a4f070f684e2b58925ce91fa9d26bb6a609b5
  • MD5 952e26b46db747c4f00cc6a59e082393
  • SHA1 e7982e58ba2bb5c8af12c526d8b74344b9854901
  • SHA512 cf6b294e5dbf11fb79986b78371a9aa432e3c58d0ac24cd4340946518dcd27e50739d4e0d2d558f9c345f74ee1888594a053f37e24d68a76bebd14d7749ffe56
  • SSDEEP 3072:RwKFbUahnsANF2vCMWmZb9oZU9i3QKHyiTph0EtJmAlacLZr:RwKNtns8F2vxrgUI0EtJjY+l
  • TLSH
    T120B36C50B6D08471E5BE0A3C0874EA655B3F7D60EF608DEB27581AA94E317D08F35B2B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral10behavioral9
• • Target
    runtimes/win-x86/native/WebView2Loader.dll
  • Size 114KB
  • SHA256 9915bfd98e275a5147de65029e0a4f070f684e2b58925ce91fa9d26bb6a609b5
  • MD5 952e26b46db747c4f00cc6a59e082393
  • SHA1 e7982e58ba2bb5c8af12c526d8b74344b9854901
  • SHA512 cf6b294e5dbf11fb79986b78371a9aa432e3c58d0ac24cd4340946518dcd27e50739d4e0d2d558f9c345f74ee1888594a053f37e24d68a76bebd14d7749ffe56
  • SSDEEP 3072:RwKFbUahnsANF2vCMWmZb9oZU9i3QKHyiTph0EtJmAlacLZr:RwKNtns8F2vxrgUI0EtJjY+l
  • TLSH
    T120B36C50B6D08471E5BE0A3C0874EA655B3F7D60EF608DEB27581AA94E317D08F35B2B
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  3^/10

  discovery
  behavioral11behavioral12