Extracted

Extracted

• • Target
    D0cumentreview_PDF.bat
  • Size 60.3MB
  • SHA256 fc755f70ead19536894b7f1bb3e59d80868cf64feacfd7cefb377c6381ed6005
  • MD5 dc09d4c1a9f08a44153e96d3e0a0ad77
  • SHA1 c854558682b105487b913abe21f2d576da7f20ee
  • SHA512 31a03feb0f0835bc45c9a7d8673280221f11a7a5c327d9b7dfa30f77f7ce3a552894557c1905102d96d0527033beb4d067c001f67d8371c8a952e64088e2efea
  • SSDEEP 49152:N7X0cCAzYC5x1eAIT3MsKAEIDSC0//jXQy1b8x+tMwtjzgy9FZFb5M1/63EBrXI5:j
  • TLSH
    T101D72378998926DF0902E1F6B616B89575DD23870D83131703BCC2B435F94B8EFA7CA6
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasionexecutionoverlordpersistenceprivilege_escalationrat

  • Detects Overlord RAT

  • Family: Overlord

    Overlord is an open-source Windows RAT written in Golang.

    ratoverlord

  • Suspicious use of NtCreateUserProcessOtherParentProcess

    defense_evasionprivilege_escalation

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Deobfuscate/Decode Files or Information

    Payload decoded via CertUtil.

    defense_evasion

  • Suspicious use of SetThreadContext

  behavioral1