overlord | 5b4ce53126efb3f63c3463df55665558fcb8b6a4de573fe451828c2604fe74ec

General

Target
Audit_Report_FY2026-27.zip
Size 119KB
Sample261001-pm2ydsxtf1
SHA256 5b4ce53126efb3f63c3463df55665558fcb8b6a4de573fe451828c2604fe74ec
MD5 7c79d34e26e01a6e9c8f6033d431af9e
SHA1 fece1dd173cb492241637fce08585df581dff6bd
SHA512 33e297b9ddc61ffca2bb3d98e793aca653b03d533c36af199461c7fa8462689efde229e252e8fc0de63557ed6e426831789088a0db6e5e2afe54213de016c410
SSDEEP 3072:SaZEpWASft5BwcnDqKc9G8zbXiewdZ/hzMQglUR4:r0WASBDqdLzbkdNhP4
TLSH
T17AC312785C9A4379A9D11EA320E57CF32B26269D4D7B6A86EBFCC4E8520427CC31477C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  Audit_Report_FY2026-27.exe
- Size 222KB
- SHA256 1688fe4698c45680851f5d90aff71fffdccb19c1b283a8c10cbc729c8efca7d8
- MD5 0b631263c1d1584a0e8fc21bf3ee3093
- SHA1 2ca980a55e99bcae8927e65a13b22e927b9f8620
- SHA512 4059af60b446ff26ca1b7a70ce0a0567a323d3c037faf9d0f849bb1dcf30dea95813abc46435e0308f6c0cbe5098c1f82d87f114217eb6cdd33d17b14fdf98f9
- SSDEEP 3072:5jZ8yFFYIzNBapJw/pV2JdqLVZjHAhQ+IgNo36J3BJicSyt:bEESJdqJZjHCO36ZRt
- TLSH
  T14A24F95272E440D0E3A963398522DA99EAB17C26976193CF8350767A1F33BD39C3B31D
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery overlord persistence rat
- Detects Overlord RAT
- Family: Overlord
  Overlord is an open-source Windows RAT written in Golang.
  rat overlord
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Suspicious use of SetThreadContext
behavioral1
- Target
  tedutil.dll
- Size 104KB
- SHA256 e2ab6240861ea9e1f148bb8a38eea4a5f17f4a9271ca67f272bae16859457f1d
- MD5 46f3499302ddf5ac322954f32ac256c2
- SHA1 79902bce03bd8cc029d2d78c4921a90537c01193
- SHA512 bfcd477370f412e89668a6be1747c1d6c4a7169d635eafa9393a2033373811ab5447219b58ea1a055495688207ef6fbf2de5e1033631d2702f3d869e69f5508a
- SSDEEP 3072:GZAJH296DzRUQo+plGF9fEF0xf7CR4XO81i74x+4bSds/H4Byb8FW8TK5zzh9HIm:GKod8F017CR4XO81i74x+4bSds/H4Byt
- TLSH
  T111A3544565B4BCB8C526803D9213632293B23C4DC3326667BAE9DD643F97F606B1E7E0
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

discovery overlord persistence rat
- Detects Overlord RAT
- Family: Overlord
  Overlord is an open-source Windows RAT written in Golang.
  rat overlord
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Suspicious use of SetThreadContext
behavioral2 behavioral3