Overview

overview

10

Static

static

1

SolaraExec...37.zip

windows11-21h2-x64

10

Sharing

Copy URL Twitter E-mail

General

  • Target
    SolaraExecutor_pw1337.zip
  • Size 497KB
  • Sample261103-vxavjsdz8k
  • SHA256 122f5fc393a296882354ced57f61e3997c358a308a99b3f48f0720afbefea450
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
overlordxmrigdefense_evasiondiscoveryexecutionminerpersistencerat

Malware Config

Extracted

Family

  • overlord

C2

  • 734r7hw4s32wehashwdz273dn323eeasd.antimalwarediagnostics.st

Extracted

Family

  • overlord

C2

  • 734r7hw4s32wehashwdz273dn323eeasd.antimalwarediagnostics.st

Targets

    • Target
      SolaraExecutor_pw1337.zip
    • Size 497KB
    • SHA256 122f5fc393a296882354ced57f61e3997c358a308a99b3f48f0720afbefea450
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    defense_evasiondiscoveryexecutionoverlordxmrigminerpersistencerat

    • Detects Overlord RAT

    • Family: Overlord

      Overlord is an open-source Windows RAT written in Golang.

      ratoverlord

    • Family: xmrig

      XMRig is a high performance, open source, cross platform CPU/GPU miner.

      minerxmrig

    • XMRig Miner payload

      miner

    • Command and Scripting Interpreter: PowerShell

      Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

      execution

    • Downloads MZ/PE file

    • Modifies Windows Firewall

      defense_evasion

    • Executes dropped EXE

    • Loads dropped DLL

    behavioral1

MITRE ATT&CK Enterprise v16

Tasks