Extracted

• • Target
    Loader.exe
  • Size 60.4MB
  • SHA256 1157b2e0c5d337e099f2101f4b9474a590af18938a2f35896f0245f237653bc6
  • MD5 2d53c3d62ba855970af5733780c359cc
  • SHA1 835740912004c63e76474d0fc67f5d51edc65eb8
  • SHA512 e5cccf244cb10347dfb3277244f284968bf3044a8de00a53a8f039965f0401aa36d8fea581b600566ef930fb5295ae23d1891ceb537f7058e4323baaae098311
  • SSDEEP 786432:gMguj8Q4VfvOqFTrYzbml93m7qy6TRvGt3I2RXGMFa+d:giAQIHOkHS8W7qyi5QIlKa+d
  • TLSH
    T176D7CE1773E60195E9B7D1388AA64507D773B8638331CBDF329D06152FABAD09A3E720
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  overlordpersistenceratdefense_evasiondiscovery

  • Detects Overlord RAT

  • Family: Overlord

    Overlord is an open-source Windows RAT written in Golang.

    ratoverlord

  • Modifies Windows Firewall

    defense_evasion

  • Executes dropped EXE

  • Loads dropped DLL

  • Registers new Windows logon scripts automatically executed at logon.

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2