overlord | penar[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
penar.exe
Size 10.4MB
Sample260914-3rmk6awyew
SHA256 f9c683b70e66cb6aeb67ec10dfa7816b24580895def881094a536b5d82a0598a
MD5 382a5677975c835aed694ef9d4cc950f
SHA1 dd0b8b9cc9c0516690236c13e5ca6b17c0ba7aaa
SHA512 ede46b7f8d2ab37bc766cede2f88fc0fd86d81c7f89b370690a6c010c924686c5b357091b4a031f4a07bf6a6d9c85c850703d22b88281bbe094dcbada4e7961a
SSDEEP 98304:mHQ8/VGDW3DksZ5vm9LXBuCpEKf9XLUUsmR9D5NUfnvEW1q:4B995vCXw3GD5i
TLSH
T11BB64917E95954E9C4AEE234C9669223BBB17C490B3033D72BA0FA246F37BD05DB9710
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat overlord

Malware Config

Extracted

Family

overlord

2.27.202.24:5173

Extracted

Family

overlord

2.27.202.24:5173

Signatures

Family: Overlord
Overlord is an open-source Windows RAT written in Golang.
rat overlord

Detects Overlord RAT 1 IoCs

resource	yara_rule
sample	family_overlord

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
penar.exe

File Explorer

penar.exe

.exe 10.4MB

penar.exe

IMPHASH e2bf3ea500ed6add4b896d96c842dc0a
SHA256 f9c683b70e66cb6aeb67ec10dfa7816b24580895def881094a536b5d82a0598a
MD5 382a5677975c835aed694ef9d4cc950f
SHA1 dd0b8b9cc9c0516690236c13e5ca6b17c0ba7aaa
SHA512 ede46b7f8d2ab37bc766cede2f88fc0fd86d81c7f89b370690a6c010c924686c5b357091b4a031f4a07bf6a6d9c85c850703d22b88281bbe094dcbada4e7961a
SSDEEP 98304:mHQ8/VGDW3DksZ5vm9LXBuCpEKf9XLUUsmR9D5NUfnvEW1q:4B995vCXw3GD5i
TLSH
T11BB64917E95954E9C4AEE234C9669223BBB17C490B3033D72BA0FA246F37BD05DB9710
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects Overlord RAT
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5296

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

d3d11

D3D11CreateDevice

kernel32

AddVectoredContinueHandler AddVectoredExceptionHandler CloseHandle CreateEventA CreateFileA CreateFileW CreateIoCompletionPort CreateSemaphoreA CreateSemaphoreW CreateThread CreateWaitableTimerExW DeleteCriticalSection DuplicateHandle EnterCriticalSection ExitProcess FreeEnvironmentStringsW FreeLibrary GetConsoleMode GetCurrentThreadId GetEnvironmentStringsW GetErrorMode GetFileInformationByHandle GetLastError GetModuleHandleA GetModuleHandleW GetProcAddress GetProcessAffinityMask GetQueuedCompletionStatusEx GetStartupInfoA GetStdHandle GetSystemDirectoryA GetSystemInfo GetSystemTimeAsFileTime GetThreadContext GetTimeZoneInformation InitializeCriticalSection IsDBCSLeadByteEx LeaveCriticalSection LoadLibraryA LoadLibraryExW LoadLibraryW MultiByteToWideChar PostQueuedCompletionStatus QueryPerformanceCounter QueryPerformanceFrequency RaiseException RaiseFailFastException ReadFile ReleaseSemaphore ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetConsoleCtrlHandler SetErrorMode SetEvent SetLastError SetProcessPriorityBoost SetThreadContext SetThreadPriority SetUnhandledExceptionFilter SetWaitableTimer Sleep SuspendThread SwitchToThread TlsAlloc TlsFree TlsGetValue TlsSetValue VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WerGetFlags WerSetFlags WideCharToMultiByte WriteConsoleW WriteFile __C_specific_handler

msvcrt

___lc_codepage_func ___mb_cur_max_func __initenv __iob_func __getmainargs __set_app_type _acmdln __setusermatherr _amsg_exit _assert _cexit _commode _fmode _errno memchr memcmp memcpy memmove memset _initterm _lock _onexit _stricmp _unlock _wfopen abort calloc exit fclose fopen fprintf fputc fputs fread free fseek ftell fwrite localeconv malloc realloc signal strcmp strerror strlen strncmp strncpy vfprintf wcslen _read _close

ole32

CoTaskMemFree

Name

.text

Size

5.0MB

Virtual Size

5.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

440KB

Virtual Size

440KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

4.7MB

Virtual Size

4.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

137KB

Virtual Size

137KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

27KB

Virtual Size

27KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

32.4MB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

124B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

5KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.CRT

Size

512B

Virtual Size

96B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

16B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

93KB

Virtual Size

92KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Extracted

Signatures

File Explorer

penar.exe

d3d11

kernel32

msvcrt

ole32

generic