Extracted

Extracted

• • Target
    Guns.lol viewbot.exe
  • Size 71.0MB
  • SHA256 43cbb951d6f30351b22977eb5b0a9a2e2df44e4f9f7bd19fde5792ae74e8423e
  • MD5 55abaef12f7ad08e053c1d81a1c80c51
  • SHA1 1575fc0b0fbf666ea74b14a3975a77e92d1df251
  • SHA512 5360a507e8f60ac64e3ce0695cb6d17b5498596e09b30ff477a49656cb30e2021517454d93f8143f5ff6bb6a7ed41e75229bcbc1850b789b79749d79720c6f01
  • SSDEEP 1572864:877IhCyt/tmo97nBack+bZHIfV2OGVCUe5QEOMPk:877NytMo97nBack42N2jemEO6
  • TLSH
    T189F733B57309D840F50489BE854F243F8A09BA265FEC969DD05988F633E2A2937735FC
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionoverlordxmrigminerpersistenceratupx

  • Detects Overlord RAT

  • Family: Overlord

    Overlord is an open-source Windows RAT written in Golang.

    ratoverlord

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • Process spawned unexpected child process

    This typically indicates the parent process was compromised via an exploit or macro.

  • XMRig Miner payload

    miner

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Executes dropped EXE

  • Loads dropped DLL

  • Registers new Windows logon scripts automatically executed at logon.

    persistence

  • Stops running service(s)

    defense_evasionexecution

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Network Share Discovery

    Attempt to gather information on host network.

    discovery

  • Drops file in System32 directory

  • Executes a VBScript file via the Windows Script Host.

    execution

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2