Extracted

• • Target
    agent-windows-amd64.exe
  • Size 10.5MB
  • SHA256 80a1dc7015617f30d8b825eff3c015343140059913ad58ab12059160cb2ae6a4
  • MD5 5459c036b72e93d0893a5806ee61f148
  • SHA1 ba1e3a134b19fcc18d933c667974b98164cb7baf
  • SHA512 629e2a3a2077c9bc63102a65868a6b4f4bddc971e0da08aa97302e433c12f598deba8ebb200f71d13398c96a992e63bcc3ff92f6c473867d41cad5c0043c1fc8
  • SSDEEP 98304:SFgtIZljb+qyH7XBuOCShf9oJ40mE6DnxMlM:Su0ln+NtuOC7JlD6Dnv
  • TLSH
    T108B64A07E99615E8C1AFD13189769213BB717C890B2023D72BA0F7346F76BD0AEB9750
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryexecutionoverlordpersistenceprivilege_escalationrat

  • Detects Overlord RAT

  • Family: Overlord

    Overlord is an open-source Windows RAT written in Golang.

    ratoverlord

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  behavioral1behavioral2