Extracted

• • Target
    agent-windows-amd64-e94d6a4c.exe
  • Size 12.8MB
  • SHA256 a0ee95b0e007ade517ab23bb8eb4cee626c0593812f5a359015f3dc59e9d651f
  • MD5 873e4bfcd7edfe075ccbce5fc7b98222
  • SHA1 634d71c181a98d0f6a1136782b0b325653546c13
  • SHA512 0b468711caca2b5756a5389888c014e74cb2f124bc20bed4510bce6ae1411606151083acfccbfdcf76a784bbd6d469b4c1c3dbed26d18c2f8dd6337a722219ff
  • SSDEEP 98304:ctbj2sFC0CGnrnv5zxr5rbK5D0DYaBzy5c8RE:chDlr5r25D0DYrcd
  • TLSH
    T1F6D64B57EC6A05E9C4AED134897691237B717C894B2023D72B90F6382F37BD06EBA750
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  discoveryoverlordpersistenceprivilege_escalationratadwareransomwarespyware

  • Detects Overlord RAT

  • Family: Overlord

    Overlord is an open-source Windows RAT written in Golang.

    ratoverlord

  • Boot or Logon Autostart Execution: Active Setup

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2