Extracted

Extracted

• • Target
    overlord-server.crt
  • Size 1KB
  • SHA256 c0a375a27607d1b4c9ad27587a28488b98f428c6d43903e6013f9f9afb0548b3
  • MD5 d5640d67d3a65b6bc3204c702c18071e
  • SHA1 90b3a44928bf4656cbb8dde3ae7a959b1d923bf6
  • SHA512 9855d35df1bb38d6502c97d79ab490f477909f94e6fae8627560867c9468b33bd0c12419bfc251bb3315a3bc693f0e46b7f033a901e990394e70be06372c5b77
  • TLSH
    T19221E6770E64A4BA396350C7C14B199D0F380173C64BBA771DEB62C0C2BA90054BD0EC
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  discoveryexecutionoverlordrat

  • Detects Overlord RAT

  • Family: Overlord

    Overlord is an open-source Windows RAT written in Golang.

    ratoverlord

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious clipboard content.

    A suspicious script was copied to clipboard.

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1