Extracted

• • Target
    agent-windows-amd64-5111bc4d.cmd
  • Size 7.6MB
  • SHA256 86936a8d4066cc34becabee88be54acf4b0c6cf941d96c517611740c66a42cf4
  • MD5 3de95f27fd6961d4176aae98e1f59daf
  • SHA1 40b74d7e3635faec7a04357714c2e4654fe363e0
  • SHA512 e5c184cb927e6648aabfd60c2e1065840984c0b5fb4ff830b9634dbdbfaf5b4a4e3bacbcd6796131f1f6d47fd89e928d08cb4b2d0a65ab094de31488f1a9298c
  • SSDEEP 49152:AD87C5r98gLkrjLVZs2z3Sok1ZxxSzSSW9DcnfWFsyuNMxhhjsn5WDZTaQPCtL+5:i
  • TLSH
    T1F0862339831B16EEC91152FBFC196CC534ACA3CB05C513698798F67435ED4788ABF8A2
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdiscoveryexecutionoverlordpersistenceprivilege_escalationratspywarestealerupx

  • Detects Overlord RAT

  • Family: Overlord

    Overlord is an open-source Windows RAT written in Golang.

    ratoverlord

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads ssh keys stored on the system

    Tries to access SSH used by SSH programs.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Adds Run key to start application

    persistence

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2