Extracted

• • Target
    AK/MonitorInfo6.exe
  • Size 292KB
  • SHA256 894aeebd244459f700c03f17371ebe1ccd9b8f90533910cfd713a01cfd6a4d39
  • MD5 8c3978a8084ea687b3483d2c041ebe87
  • SHA1 79bbc9b0c70a4d31224e7d1e17837fbe8d85842c
  • SHA512 5457c41a5bd544d6a9f69fa9dc0cdaefeeec3ba23b8dc833be7d4e2950d2e5b9c9147133daa1eb2964521975b7537a0b68e8fce8e25427e170c9f73eb541408f
  • SSDEEP 6144:PI6L5YGln4hfcVF+xCuFBqy8yguecJWszkkdAu:wYSWnsvUqysjdx
  • TLSH
    T1E6546C23975809B5E576C2BCCA838403EBB67C5713A1D2CB0BD19A662F27ED42F76701
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryoverlordpersistenceprivilege_escalationrat

  • Detects Overlord RAT

  • Family: Overlord

    Overlord is an open-source Windows RAT written in Golang.

    ratoverlord

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Modifies Windows Firewall

    defense_evasion

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2
• • Target
    AK/libmfx64-gen.dll
  • Size 216KB
  • SHA256 61d01af7883f433d739f4d397132ce1fc0576127a3a1737f1d685f4a913c3e19
  • MD5 34931e5e9d85be82984439c1e69adf11
  • SHA1 50134e5bd1e24884daab5b3bf7474238f9dc93cd
  • SHA512 b0a419be1c64584a4e268236a6f647d83ccb4a71a005c946e38402988fd6a776b65720d4ee798497da5da7927de37bd1b0ffe7c2780582d2db46eef97254317e
  • SSDEEP 768:4AO6BP33333Y/F4tv7wwMTD3psAgt5dGkGpO2fXw1:POm3333GF4tv7wwWTgt5RGPfu
  • TLSH
    T1BD2401046280ECAACE70C6B995FD4741A734867A6372F37B93A802745D16AC1CEBF651
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral3behavioral4
• • Target
    AK/libmfxhw64.dll
  • Size 216KB
  • SHA256 61d01af7883f433d739f4d397132ce1fc0576127a3a1737f1d685f4a913c3e19
  • MD5 34931e5e9d85be82984439c1e69adf11
  • SHA1 50134e5bd1e24884daab5b3bf7474238f9dc93cd
  • SHA512 b0a419be1c64584a4e268236a6f647d83ccb4a71a005c946e38402988fd6a776b65720d4ee798497da5da7927de37bd1b0ffe7c2780582d2db46eef97254317e
  • SSDEEP 768:4AO6BP33333Y/F4tv7wwMTD3psAgt5dGkGpO2fXw1:POm3333GF4tv7wwWTgt5RGPfu
  • TLSH
    T1BD2401046280ECAACE70C6B995FD4741A734867A6372F37B93A802745D16AC1CEBF651
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral5behavioral6
• • Target
    AK/libvplswref64.dll
  • Size 216KB
  • SHA256 61d01af7883f433d739f4d397132ce1fc0576127a3a1737f1d685f4a913c3e19
  • MD5 34931e5e9d85be82984439c1e69adf11
  • SHA1 50134e5bd1e24884daab5b3bf7474238f9dc93cd
  • SHA512 b0a419be1c64584a4e268236a6f647d83ccb4a71a005c946e38402988fd6a776b65720d4ee798497da5da7927de37bd1b0ffe7c2780582d2db46eef97254317e
  • SSDEEP 768:4AO6BP33333Y/F4tv7wwMTD3psAgt5dGkGpO2fXw1:POm3333GF4tv7wwWTgt5RGPfu
  • TLSH
    T1BD2401046280ECAACE70C6B995FD4741A734867A6372F37B93A802745D16AC1CEBF651
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral7behavioral8