Extracted

Extracted

• • Target
    Guns.lol viewbot/Guns.lol viewbot/Guns.lol viewbot 2.34.exe
  • Size 71.0MB
  • SHA256 e710c578b7c63c76ced706dfbc4fe4c4d5b75bcde9b15943095a7266abec697d
  • MD5 9707da370a6e655dcaf2aae722eadede
  • SHA1 c28dca97d7a55bf94d50cdff640c7ca0f60dc07f
  • SHA512 2d18e719acbaeab554fed5cf7eedfdf4ad8474e136bd3ad26d4e9593a1063f039de1b26cb285a8e2db817dd711fc8ae59f13d6a945ec5c3b8317772a1bd30556
  • SSDEEP 1572864:gEigCtE+Ws9EgvCt/s2yQJrfMS7MsCYU515ZU0uiG1Hms8:ggIygv2fBJrfMGUz5uV1Hms
  • TLSH
    T15CF733A800EBBAD5FC1A987349D5F0CF8634D60F81539B197E709E8692717D1FA8206F
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionoverlordxmrigminerpersistenceratupx

  • Detects Overlord RAT

  • Family: Overlord

    Overlord is an open-source Windows RAT written in Golang.

    ratoverlord

  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig

  • XMRig Miner payload

    miner

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Downloads MZ/PE file

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates new service(s)

    persistenceexecution

  • Executes dropped EXE

  • Loads dropped DLL

  • Registers new Windows logon scripts automatically executed at logon.

    persistence

  • Stops running service(s)

    defense_evasionexecution

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Network Share Discovery

    Attempt to gather information on host network.

    discovery

  • Drops file in System32 directory

  • Suspicious use of SetThreadContext

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2