overlord | 50e2d8a24a26e22cc179767299fd65dde83bd166ab8ed9c3ae25278a1b953cfc

General

Target
CP14_Notice_D2921116870_2025_2026-10-27.zip
Size 1.9MB
Sample261103-pderhahs6s
SHA256 50e2d8a24a26e22cc179767299fd65dde83bd166ab8ed9c3ae25278a1b953cfc
MD5 bd0cb5834fc3869427d34bfe8722f141
SHA1 0a93dd05b674d12ed2d2fa4d19bb969142e419cb
SHA512 d8ac26d22e9a635eed18b2c2c942b5d1f467b1db60b08c4222b6e0f898c93c54429bd62d8816f1858423fd238c8b0991757aa74f5c7f094d70c8367708c1a9a4
SSDEEP 49152:QcO/KSuamZHjjtaEGl0jIvMd4b1nogyXNl5sEOpmsRv6CF:QdxkHjjkNTEd4bCxNcLpmKiu
TLSH
T1E2953327BF6EEECFF40120750C6856306D048D8FA65B9F898EE7E86D549ED88372D046
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

Malware Config

Targets

- Target
  CP14_Notice_D2921116870_2025_2026-10-27.exe
- Size 5.5MB
- SHA256 e0ee8df47283ea4b1db8662dc7409b9069753de14754258b761c40b4e0cb19c2
- MD5 1432ce9587f2dbda35f0e75a4640d54d
- SHA1 0cddc429caabe8daad56db630917eebcb8219791
- SHA512 cac1666eeeb7705a2ffad56e85f02d1da9adbefc6450e73082bd96bf2e26c2220253d4294cd2d1ddbba9b37647c48f9c02f5401b0a8558e1a25852b473cc370f
- SSDEEP 49152:adh9YVyu1P6qpigJ74LYLZQS+Bnff5nWhJ60V3jskd0RWTRZEhZFUAI:aJWjNHo/2TIHuh
- TLSH
  T1A0463A7BB2A09169C19EC23ED5B78F50D93370B92B32C5EB52E243651F169C06E7F620
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery overlord persistence rat
- Detects Overlord RAT
- Family: Overlord
  Overlord is an open-source Windows RAT written in Golang.
  rat overlord
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Suspicious use of SetThreadContext
behavioral1 behavioral2
- Target
  badata_x64.dll
- Size 132KB
- SHA256 78714f6f57c5177201837ce7a6185a2b2bb00a074883fc6cf03b8ade192a20ba
- MD5 8d7543cca0e3da65caa54a9781fd2850
- SHA1 ba43be545dd5c21d756345bd50be97ba54453820
- SHA512 f650c9d7087d61570143dcfb51a1f786d3571bf7d20a5a0ef2505ea4ce3150831ab3a62b05821983f15eb4a116a4334a103c726ee56dfaa41bbc324fdc9a6ae9
- SSDEEP 3072:L+RMdShItP5x4DIDUL1e8fzjQSrYBuXry18/G4hyLc8aczHp6CWfMVqDQQLTcpk3:L+RMQbL8SrYBuXry18/G4hyLc8aczHpF
- TLSH
  T1F7D353153274787CCA67913E8102632292F23C5DD32152376AA9AD743FA7E612B3E7F4
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

10^/10

defense_evasion discovery overlord persistence rat
- Detects Overlord RAT
- Family: Overlord
  Overlord is an open-source Windows RAT written in Golang.
  rat overlord
- Badlisted process makes network request
  Network request originating from process or tool commonly abused by malware.
- Executes dropped EXE
- Adds Run key to start application
  persistence
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
  discovery
- Suspicious use of SetThreadContext
behavioral3 behavioral4