Extracted

• • Target
    svchost-windows-amd64-918843f6.exe
  • Size 9.4MB
  • SHA256 1ee6932842c6ec82da8c5d83ff8cf89fbbd83ceec55fee749dfd8bce67f2c265
  • MD5 ed7a0c4e30872d25a030232571512da8
  • SHA1 b4dcc1e2b7ea0de391856e71ef7768a9b8a59427
  • SHA512 da646cb35bdecae73614bb9d30943912af27ffaa5ad3dd610e10a8e4c0d1e7e9f5e1f20f90c25152ee8e3b8f6217cf22b8753074615d9f8b834365fa85c005ba
  • SSDEEP 98304:7oS9Po0sOP+YpK/dh9WpQfDhfuSIaneOAkE/4:7ZeOlpQfDhiL
  • TLSH
    T1CAA62807FC6555E8C4AEC270897696237B727C495B3123D72F90B6282F36BD0AEB9350
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryoverlordpersistenceprivilege_escalationratadwareransomwarespyware

  • Detects Overlord RAT

  • Family: Overlord

    Overlord is an open-source Windows RAT written in Golang.

    ratoverlord

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes a file named after a Windows system binary

    The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

    defense_evasion

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2