Extracted

Extracted

• • Target
    s.ps1
  • Size 645B
  • SHA256 7a9f8afbe39560ea52daada8700749371f189345aa7ec213dbdb537387c01d79
  • MD5 9428d170875f6b96e77f43510649b116
  • SHA1 4f87706ea1e555eb9dde5de78d803c619eea8f4f
  • SHA512 63a4cc91d19f2757ef53177e87cbac164e77c5a3164f4d4ee40a0c750ae5f43e27a8a3e79cb9ae1e630d1755fd766d3c2bfb3f89e90837de400172e73c9a3174
  • TLSH
    T1EFF062631394C89881E46820A339B4E2C47B789A300D8D40F6E5DE09D634F59B28C1DE
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  executionoverlordratupx

  • Detects Overlord RAT

  • Family: Overlord

    Overlord is an open-source Windows RAT written in Golang.

    ratoverlord

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Executes dropped EXE

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2