Extracted

• • Target
    920f6d5e4fea636959543da0e7f629c045dd4c922d39db887bcf3fdb141cbc53.exe
  • Size 17.4MB
  • SHA256 920f6d5e4fea636959543da0e7f629c045dd4c922d39db887bcf3fdb141cbc53
  • MD5 d4ecae7fa56d43b1629e963c1d7eaee7
  • SHA1 7ef02987ac4907eac9882eccddfff37875dd2926
  • SHA512 ccb03cbd3c6ffa169450c9f51199bfad2003f31ad1f7f053e9bb582ccdf9547666e690700d21bf16af316d56e48589478b6facbb78c0212b58df69bb2bb79a40
  • SSDEEP 196608:aeCEW2OnF0VphOaivVZkHTNt62bRqxFQW03SwNqlcstFFdmzhuyGJfi5XTJohMIq:aXEW2mFShQa02MHQd3+lc2fT6IG
  • TLSH
    T178073308D7EB6510E4A44FF044A0134F0A3EBDEA52A5468F74EEF1679632BD426F1B2D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionoverlordpersistenceprivilege_escalationrat

  • Detects Overlord RAT

  • Family: Overlord

    Overlord is an open-source Windows RAT written in Golang.

    ratoverlord

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Deletes itself

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1