General
- Target crypted.exe
- Size 13.4MB
- Sample261024-waxapsc14k
- SHA256 555d33e8051e8828b86c2f5804f8a40bdeaaef979c335b1206093d6c8dfd9d04
- MD5 ca5d12abb73c4753b5cccff5988f6720
- SHA1 96f3e529496f768d9d5eb0e44a4222385e5e51e7
- SHA512 6f16e4830a0a8538181cdb8d74f3a8b1199f03c2cf299e461c7ff932bae748b6b1ec0a8fb954c62324c8c8622bd571e2b164e8a647fe5c433db9010c60ce4e48
- SSDEEP 393216:OfgCvnjUKtQQ9WB8wErhU5tPNpqCuDT/Dk6/+YdB:5CPYKeQ9s8wErhip6fDg
- TLSH T169E633486E6797EAC12ADA3EC59321E299653811C1360DFFBFA6F7F5315C224238C670
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
crypted.exe
Resource
win10v2004-20260911-en
5 signatures
30 seconds
Behavioral task
behavioral2
Sample
crypted.exe
Resource
win11ltsc2024-20260911-en
0 signatures
30 seconds
Malware Config
Extracted
Family
-
overlord
C2
-
overlord.undo.it:5173
Extracted
Family
-
overlord
C2
-
overlord.undo.it:5173
Targets
-
- Target crypted.exe
- Size 13.4MB
- SHA256 555d33e8051e8828b86c2f5804f8a40bdeaaef979c335b1206093d6c8dfd9d04
- MD5 ca5d12abb73c4753b5cccff5988f6720
- SHA1 96f3e529496f768d9d5eb0e44a4222385e5e51e7
- SHA512 6f16e4830a0a8538181cdb8d74f3a8b1199f03c2cf299e461c7ff932bae748b6b1ec0a8fb954c62324c8c8622bd571e2b164e8a647fe5c433db9010c60ce4e48
- SSDEEP 393216:OfgCvnjUKtQQ9WB8wErhU5tPNpqCuDT/Dk6/+YdB:5CPYKeQ9s8wErhip6fDg
- TLSH T169E633486E6797EAC12ADA3EC59321E299653811C1360DFFBFA6F7F5315C224238C670
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Detects Overlord RAT
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.