Extracted

• • Target
    2026-10-10_36eff046c0f2d4e49cc14e46a4d4ee05_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
  • Size 9.4MB
  • SHA256 f342ebaf61b428c93fef2211f6a851791de87a05bb6cf1a561928dd577883cb7
  • MD5 36eff046c0f2d4e49cc14e46a4d4ee05
  • SHA1 fcfceb7e13826c50fd700044c27510ab3a74671c
  • SHA512 996dede3a3f27a9f1c6cef96e1b250461f2939b7f43409b2ce970bf06af6cd8400eb88a7086cb30314646b31eaa14ceff3cb57c457dca197965d9a3e83e9410a
  • SSDEEP 98304:7oS9Po0sOP+YpK/dh9WpQLDhfuSIaneOAkE/4:7ZeOlpQLDhiL
  • TLSH
    T18AA62807FC6555E8C4AEC270897696237B727C495B3123D72F90B6282F36BD0AEB9350
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryoverlordpersistenceprivilege_escalationrat

  • Detects Overlord RAT

  • Family: Overlord

    Overlord is an open-source Windows RAT written in Golang.

    ratoverlord

  • Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes a file named after a Windows system binary

    The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

    defense_evasion

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2