Extracted

• • Target
    atlasb_final.bat
  • Size 5KB
  • SHA256 477fe8ce1e1ae5aa114bce656a1c1dd5381a196d34c40d99b5228826185c34af
  • MD5 7fac1803f086100d297c11fcc3ab62c9
  • SHA1 e77a992aecf1fc9c431fbc21cf3bcaf29e6b1b29
  • SHA512 30cc0bb52415ff5368aff31533ab7e9490401b31476d513ff48ce8aaa67fd9f068e08ccc66bf5c76366693482da3dfd492e507a20476e77959d73812188f48f7
  • SSDEEP 96:iuLGGgrw5ukxDjShRnHPD26fj3E/Fqv/0ffiowE+P2EC3DoroMrWspodj8A1uiVD:VGG/5ukxnShRnHPD26fj38Avsfa9bP2v
  • TLSH
    T123C1409FBC112CA4812292E554B26986E4D2DA175F01FDD8F0E344E23B32BE163E8DCD
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  executionpersistenceadwarediscoveryoverlordransomwareratspyware

  • Family: Overlord

    Overlord is an open-source Windows RAT written in Golang.

    ratoverlord

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Downloads MZ/PE file

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Command and Scripting Interpreter: PowerShell

    Using powershell.exe command.

    execution

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2