Extracted

• • Target
    Noise+.rar
  • Size 7.7MB
  • SHA256 129b3600ce09240332c971932b4a93dd1be7e6fc260e07d7c176a19fdca52e9b
  • MD5 1123a8bbe768c49d789d7f990f473143
  • SHA1 8f2e0ed679b5787909532efebb3c08a33951093f
  • SHA512 035ea929fdd490bd912ccf41f23276ab0e79c7e1d21d0cde950ee0595f6fd968a4c2962495b1b7c0983a0671710bd76b5696e4b59ecb2a2e32651cb449bf08f8
  • SSDEEP 196608:dIibEKVErp1cnqj1yscwVf3n4uXChu1UnqPj/zmhujf3r/g:dTbE2Fqpyux3n4u+u1LzqE/g
  • TLSH
    T1CD86332C02B0FB967CF08D481FA56C068115C67F469476C4F9BCAE8E676B2A3ED1139D
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  1^/10
  behavioral1behavioral2
• • Target
    Noise+/Noise+-README.txt
  • Size 2KB
  • SHA256 67126abd0058612d9e33f562fa59a0d85ffc76a941741b7063e12ac539706d45
  • MD5 1b47f9736e1bb13a24cce9d88b947183
  • SHA1 34d78a2c7860f59c542d7fbb5cfc448bea6f9991
  • SHA512 ec73b4ba3512fbc458b0be05c869f4eb3ffa4dec22bd4767760e2305d5787a398eb47883737f2eeac85691cc0d8b66f1f8c74c688e116dd4648948b0b7122ba2
  • TLSH
    T18051981ED31F76B311939461ED7E01CBEF4A483511970B325525019CB6A936FC2334C2
  • MD5 SHA1 SHA512 TLSH

  Score

  1^/10
  behavioral3behavioral4
• • Target
    Noise+/Noise+.dll
  • Size 7.9MB
  • SHA256 6be3eef8485ebf3def65b04a1d2c05215421293bdc130fe0882ee3dfb1554022
  • MD5 98f0f1a4fb412594a554a4306211cfa8
  • SHA1 15afe93cabcb6af0dc939612963901ada237075b
  • SHA512 07d617cee3b303512a2c2b2b4355944ddce95c6316436b11b7ae624c4842cd0ba576733dc0be221a5f13d506238fd956d96d38d571564c945dd72fd4602ec7a0
  • SSDEEP 196608:MN16vlSN8PB1UesnxegsE1AsOd1FaFwzobCg:c6tS2PBhsx0yO1kM0Cg
  • TLSH
    T16C86334675CE952EC5A1C674D21510B8F20E3AC4CEB65A4B9F6B2709EEB3E31C07E742
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionoverlordpersistenceprivilege_escalationratspywarestealer

  • Detects Overlord RAT

  • Family: Overlord

    Overlord is an open-source Windows RAT written in Golang.

    ratoverlord

  • Suspicious use of NtCreateUserProcessOtherParentProcess

    defense_evasionprivilege_escalation

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Executes dropped EXE

  • Loads dropped DLL

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Registers new Windows logon scripts automatically executed at logon.

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral5behavioral6