Extracted

• • Target
    2026-08-20_9afc884c82e7bfdff9faf0e5d2169101_coinminer_dosia_glassworm_icedid_luca-stealer_njrat_poet-rat_quasar-rat
  • Size 79.1MB
  • SHA256 1a61bc31f5d748dee933d0e6cec694205b01f29456b4cab7ad8d74b5f13ec65f
  • MD5 9afc884c82e7bfdff9faf0e5d2169101
  • SHA1 86fb60649926d62184bc5e39a83adae1f5e2bd13
  • SHA512 d9ffed728814e0f83f30e5c4c4b58d33e8f2b8e8884fea658dca92a18dfbe691585c454f26fbd9555b56349d9ecbc1cfa69b95d03380264d2b1c84d387e0f85e
  • SSDEEP 1572864:/cqrTIAr5k19MSgznQpT0bqrTIAr5k19MSgznQpT:13J6pZ3J6p
  • TLSH
    T17708DF17E96514E5C0AED134C676A263BB717C494B3023D72B60B6247F73BE0AEBA314
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdefense_evasiondiscoveryexecutionoverlordpersistenceprivilege_escalationpyinstallerratspywarestealer

  • Detects Overlord RAT

  • Family: Overlord

    Overlord is an open-source Windows RAT written in Golang.

    ratoverlord

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Modifies Windows Firewall

    defense_evasion

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Accesses cryptocurrency files/wallets, possible credential harvesting

    spyware

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2