Extracted

Extracted

• • Target
    Webshare 10 proxies.txt
  • Size 418B
  • SHA256 8e58cb8661f0362aad64ce2b17f0123532318d096732f80281544d00037ac2d2
  • MD5 7a6d51cf74c0a81c1997139e347f9b67
  • SHA1 d98ed46b80eea84d7415bffbe8e00bfd9186ab31
  • SHA512 8c7ad104fd9d3a9fb92089e8d9351e54b39ed44485b07cb94b050706d6534989ff72dfff9d654a70ff49b2e09fb47c01fa779872f1564242601e783a0edd27c1
  • TLSH
    T171E0EE62EC9B0A00BCD2CA4687EFFEEA012D09320631E28ECFC3162DDC02230F304A54
  • MD5 SHA1 SHA512 TLSH

  Score

  10^/10

  discoveryexecutionoverlordrat

  • Detects Overlord RAT

  • Family: Overlord

    Overlord is an open-source Windows RAT written in Golang.

    ratoverlord

  • Suspicious use of NtCreateUserProcessOtherParentProcess

  • Executes dropped EXE

  • Loads dropped DLL

  • Suspicious clipboard content.

    A suspicious script was copied to clipboard.

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext

  behavioral1