Extracted

Extracted

• • Target
    90.2.exe
  • Size 14.9MB
  • SHA256 215298ad915d98b1ff8376387558f567a676c7d8c407d7f979128bc256421e10
  • MD5 578814c9914d7828b2bf6f46a0fa8c3e
  • SHA1 e7593f27de1b8e09aaaac4c322af8df3d9f84eab
  • SHA512 fe2141cab77fa2ef3373db4c2a87d9b59275422842bf1c3caaa1cdb5f6376284f9c34b74eaf89edaf0eb67d5fdada9dba83ebf751f1f28e72aa7f879e32def77
  • SSDEEP 98304:I+EDgKHSJs2w40g4Rwhl6iUlZV5aLE9rvDg8PdLTV:I7rHZSe6QiUlZV0YtvDg
  • TLSH
    T117F64A03E86514E8C1AED534CA77A623BB717C498B2023D72B90F6247F76BD05EBA714
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  credential_accessdiscoveryoverlordpersistenceprivilege_escalationratspywarestealer

  • Detects Overlord RAT

  • Family: Overlord

    Overlord is an open-source Windows RAT written in Golang.

    ratoverlord

  • Reads WinSCP keys stored on the system

    Tries to access WinSCP stored sessions.

    spywarestealer

  • Reads data files stored by FTP clients

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer

  • Reads ssh keys stored on the system

    Tries to access SSH used by SSH programs.

    spywarestealer

  • Reads user/profile data of web browsers

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer

  • Unsecured Credentials: Credentials In Files

    Steal credentials from unsecured files.

    credential_accessstealer

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2