overlord | 2c4161723654105672bd364de18caf52bd6e14657fc595005a75ee3fd1fe27f1[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
2c4161723654105672bd364de18caf52bd6e14657fc595005a75ee3fd1fe27f1.exe
Size 10.7MB
Sample260910-mnyk9avwe1
SHA256 2c4161723654105672bd364de18caf52bd6e14657fc595005a75ee3fd1fe27f1
MD5 cc16192b05a221130b98ccf9febd7581
SHA1 bbd2458f9a5e6a596819a5b871529c2933628cc2
SHA512 20206402ae3105b05ff20a1491f31d0c0917ff86ee2b735a3a2e80e951b7b5fb071507f2999abf68f8238eb7f08d996afb0c0b4166587470d688252e90635d1f
SSDEEP 98304:34Xzu1RFhZ2vxlC3oj+Mby2vCE3MDhVG1cAP2jj:3E6RFClCMykPcDhVAe
TLSH
T1A4B64A17ECA614E9C0AED53089779227BB717C480B2423D72B50F7686F36BD06EB9B50
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat overlord

Malware Config

Extracted

Family

overlord

209.38.132.165:5173

Extracted

Family

overlord

209.38.132.165:5173

Signatures

Family: Overlord
Overlord is an open-source Windows RAT written in Golang.
rat overlord

Detects Overlord RAT 1 IoCs

resource	yara_rule
sample	family_overlord

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2c4161723654105672bd364de18caf52bd6e14657fc595005a75ee3fd1fe27f1.exe

File Explorer

2c4161723654105672bd364de18caf52bd6e14657fc595005a75ee3fd1fe27f1.exe

.exe 10.7MB

2c4161723654105672bd364de18caf52bd6e14657fc595005a75ee3fd1fe27f1.exe

IMPHASH 3f6f096ee1fd11bfc8477792caa1e024
SHA256 2c4161723654105672bd364de18caf52bd6e14657fc595005a75ee3fd1fe27f1
MD5 cc16192b05a221130b98ccf9febd7581
SHA1 bbd2458f9a5e6a596819a5b871529c2933628cc2
SHA512 20206402ae3105b05ff20a1491f31d0c0917ff86ee2b735a3a2e80e951b7b5fb071507f2999abf68f8238eb7f08d996afb0c0b4166587470d688252e90635d1f
SSDEEP 98304:34Xzu1RFhZ2vxlC3oj+Mby2vCE3MDhVG1cAP2jj:3E6RFClCMykPcDhVAe
TLSH
T1A4B64A17ECA614E9C0AED53089779227BB717C480B2423D72B50F7686F36BD06EB9B50
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects Overlord RAT
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5296

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

kernel32

AddVectoredContinueHandler AddVectoredExceptionHandler CloseHandle CreateEventA CreateEventW CreateFileA CreateFileW CreateIoCompletionPort CreateSemaphoreA CreateSemaphoreW CreateThread CreateWaitableTimerExW DeleteCriticalSection DuplicateHandle EnterCriticalSection ExitProcess FreeEnvironmentStringsW FreeLibrary GetConsoleMode GetCurrentProcess GetCurrentThread GetCurrentThreadId GetEnvironmentStringsW GetErrorMode GetFileInformationByHandle GetLastError GetModuleHandleW GetProcAddress GetProcessAffinityMask GetQueuedCompletionStatusEx GetStartupInfoA GetStdHandle GetSystemDirectoryA GetSystemInfo GetThreadContext InitializeCriticalSection InitializeCriticalSectionAndSpinCount IsDBCSLeadByteEx LeaveCriticalSection LoadLibraryA LoadLibraryExW MultiByteToWideChar PostQueuedCompletionStatus QueryPerformanceCounter QueryPerformanceFrequency RaiseFailFastException ReadFile ReleaseSemaphore ResetEvent ResumeThread RtlLookupFunctionEntry RtlVirtualUnwind SetConsoleCtrlHandler SetErrorMode SetEvent SetProcessPriorityBoost SetThreadContext SetThreadPriority SetUnhandledExceptionFilter SetWaitableTimer Sleep SuspendThread SwitchToThread TlsAlloc TlsGetValue VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WerGetFlags WerSetFlags WideCharToMultiByte WriteConsoleW WriteFile __C_specific_handler

msvcrt

___lc_codepage_func ___mb_cur_max_func __initenv __iob_func __getmainargs __set_app_type _acmdln __setusermatherr _amsg_exit _assert _beginthreadex _cexit _commode _fmode _errno _fstat64 _ftime64 memcmp memcpy memmove memset _initterm _lock _onexit _stricmp _strnicmp _unlock _wfopen _wrename _wunlink abort calloc exit fclose fopen fprintf fputc fread free fseek ftell fwrite getc islower isspace isupper isxdigit localeconv log10 malloc realloc signal strchr strcmp strcpy strcspn strerror strlen strncmp strpbrk strspn strstr strtol strtoul tolower ungetc vfprintf wcslen _strdup _fileno

Name

.text

Size

5.5MB

Virtual Size

5.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

436KB

Virtual Size

436KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

4.5MB

Virtual Size

4.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

131KB

Virtual Size

131KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

30KB

Virtual Size

30KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

32.8MB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

124B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

96B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

89KB

Virtual Size

89KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Extracted

Signatures

File Explorer

2c4161723654105672bd364de18caf52bd6e14657fc595005a75ee3fd1fe27f1.exe

kernel32

msvcrt

generic