Extracted

• • Target
    2026-11-08_69ee97aa10e34bbd63a4a21ed6418d97_coinminer_dosia_glassworm_poet-rat_quasar-rat_snatch
  • Size 13.0MB
  • SHA256 774922d2caacaf4628ed9a9938d6212f4c38a82d4f9b577b3aeb0066046caeef
  • MD5 69ee97aa10e34bbd63a4a21ed6418d97
  • SHA1 347b1762c61bd856dccc240d09270d34d676a664
  • SHA512 3ba7358c8aa32e0617dd9975a96ffba56d951c9121c69187a3ec346dccb0ffc8afa993e4a976bac95a6e6642564110b032a0e46e7cd4e9499a08f866141e4f3e
  • SSDEEP 98304:vh+mVgVyJyc4IPU5g4krjsXn6wctnPODwVea7s16sf7E:v72kookvkfsanPODwv
  • TLSH
    T1C3D63807FD6914E9C5AEC130C97292167BB17C994B2423D72B50B6287F76BE0AEBD310
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionoverlordpersistenceprivilege_escalationrat

  • Detects Overlord RAT

  • Family: Overlord

    Overlord is an open-source Windows RAT written in Golang.

    ratoverlord
  • Custom signature

    Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Modifies Windows Firewall

    defense_evasion

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence

  • Looks up external IP address via web service

    Uses a legitimate IP lookup service to find the infected system's external IP.

    discovery
  behavioral1behavioral2