Extracted

Extracted

• • Target
    dummy_agent-windows-amd64-8a7ad06b.exe
  • Size 17.2MB
  • SHA256 a85679cd42345b3214422a554f65e2450f4d36a3059e697397b504708d948779
  • MD5 1032b6b81f3575ffe0a11b71f05d93e1
  • SHA1 4a75dc530dcec5cb7821093cf3ddd7805a6d2548
  • SHA512 419bc5c8553d3a47aeb818687ad140f475c8aaccb1e41e8b2b4fc9cccafffcc55dc35feb09fa3a047eea52376aa97ea77b126a2b03edc1948c1a0e55e62e24f2
  • SSDEEP 393216:ebvZa3upqXeRVHNgxRFlO7XCpHvai8rgiUV3GEYPb:Oxa4yefHvXVrYV36D
  • TLSH
    T17B078B31B687B47E49C3329F3336E8EE2EFCDB41051939094E9FA898E7181D67395906
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryoverlordsalatstealerratstealerupx

  • Detect SalatStealer payload

  • Detects Overlord RAT

  • Family: Overlord

    Overlord is an open-source Windows RAT written in Golang.

    ratoverlord

  • Family: salatstealer

    SalatStealer is a stealer that takes sceenshot written in Golang.

    stealersalatstealer

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • UPX packed file

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  behavioral1behavioral2