Overview

overview

10

Static

static

10

agent-wind...54.exe

windows10-2004-x64

10

agent-wind...54.exe

windows10-ltsc_2021-x64

10

agent-wind...54.exe

windows11-21h2-x64

10

agent-wind...54.exe

windows11-ltsc_2024-x64

1

Sharing

Copy URL Twitter E-mail

General

  • Target
    agent-windows-amd64-d544a054.exe
  • Size 29.0MB
  • Sample260922-ckh2aatzdv
  • SHA256 5a469f3a2ed6693368c68d3ec6a7b02306f627fac9721fe0759bfd62766d7db1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
overlordcredential_accessdiscoverypersistenceprivilege_escalationratspywarestealer

Malware Config

Extracted

Family

  • overlord

C2

  • 2.27.202.24:5173

Targets

    • Target
      agent-windows-amd64-d544a054.exe
    • Size 29.0MB
    • SHA256 5a469f3a2ed6693368c68d3ec6a7b02306f627fac9721fe0759bfd62766d7db1
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    credential_accessdiscoveryoverlordpersistenceprivilege_escalationratspywarestealer

    • Detects Overlord RAT

    • Family: Overlord

      Overlord is an open-source Windows RAT written in Golang.

      ratoverlord

    • Reads WinSCP keys stored on the system

      Tries to access WinSCP stored sessions.

      spywarestealer

    • Reads data files stored by FTP clients

      Tries to access configuration files associated with programs like FileZilla.

      spywarestealer

    • Reads ssh keys stored on the system

      Tries to access SSH used by SSH programs.

      spywarestealer

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Unsecured Credentials: Credentials In Files

      Steal credentials from unsecured files.

      credential_accessstealer
    behavioral1behavioral2behavioral3behavioral4

MITRE ATT&CK Enterprise v16

Tasks