Extracted

• • Target
    Noise+.dll
  • Size 15.2MB
  • SHA256 84d29ba33e7cadc5e3b879ca629547e2e00c6728cabe62887cba500f8571588f
  • MD5 e394a52e79ba04252c02a96c10b00b75
  • SHA1 2a12f40b657de27fa1ba280fed51b6296ee5102e
  • SHA512 6815c93f41f40d8ccf8b710d1fa6097c55625a8a8c13c21b73c1a2ae5d3747056e9966174c93b281450199bf5663dfc61567ba1e9dcd1d3ede772b0661ccefbb
  • SSDEEP 196608:pzjUH+5ZtO9EziiTkplHggJsgdI6wNsVt1zpm5gc:5jUiZtOvAk3XCmIJ6/Uy
  • TLSH
    T1E7F633E8A4C168A8D456C731C950686CF26DBB56CFF4D8AF3F351206AF71C62CC95A28
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionpersistenceprivilege_escalationoverlordrat

  • Detects Overlord RAT

  • Family: Overlord

    Overlord is an open-source Windows RAT written in Golang.

    ratoverlord

  • Suspicious use of NtCreateUserProcessOtherParentProcess

    defense_evasionprivilege_escalation

  • Badlisted process makes network request

    Network request originating from process or tool commonly abused by malware.

  • Executes dropped EXE

  • Loads dropped DLL

  • Registers new Windows logon scripts automatically executed at logon.

    persistence

  • Adds Run key to start application

    persistence

  • Contacts third-party web service commonly abused for C2

    Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

  • Enumerates connected drives

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery

  • Suspicious use of SetThreadContext

  behavioral1behavioral2