Extracted

Extracted

• • Target
    2026-09-29_86ed056e8d6879c0fd4c6bba574d9763_akira_blankgrabber_glassworm_icedid_luca-stealer_njrat_rusty-stealer
  • Size 89.7MB
  • SHA256 017611d5d583630cb6cac78ce18e9906854b2797dfdc717d17053e97b9279ecb
  • MD5 86ed056e8d6879c0fd4c6bba574d9763
  • SHA1 d1b4695280b5484f630682d8cd57995c4a6f6057
  • SHA512 52861d3d3cd9848ab59c192b32baa8b6183a6ac6bb2986a7a5181c9d6029cd699e6127456c505bbdfb935e981199f0a87b2378109ac8a61fe412ef0df8eaefe2
  • SSDEEP 786432:v32DHnnh2aXbi0QGSCTA2lFgAjsGnZivqtd8:v2DHnpXbi0QGRTAugA4GZij
  • TLSH
    T183288D03F29340E8D0AEC1758796A233FA71BC494B34A6DF57845B222E76FE06B39715
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasionoverlordpersistenceprivilege_escalationrat

  • Detects Overlord RAT

  • Family: Overlord

    Overlord is an open-source Windows RAT written in Golang.

    ratoverlord

  • Suspicious use of NtCreateUserProcessOtherParentProcess

    defense_evasionprivilege_escalation

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Suspicious use of SetThreadContext

  behavioral1behavioral2