Extracted

Extracted

• • Target
    2026-11-10_e9f711f5029f1300ab606d27ab60bb6c_coinminer_dosia_glassworm_icedid_poet-rat_quasar-rat
  • Size 18.4MB
  • SHA256 234fb4fa09005c996f8174d958410fa9c480bd9dc395552d3a1603f357bedbf6
  • MD5 e9f711f5029f1300ab606d27ab60bb6c
  • SHA1 342450a37bb5b63a1843db2c9d6ede45e0784cfb
  • SHA512 e95207cf96df0d9e01c45ca2669eb70ccf48aea09967ee38e0979c76ebe4ae232d76a511a08423002f6e7f4a0b494ec456c537fc25ff801550f47f3c30838c8d
  • SSDEEP 98304:fr/na0Z0fnXNW8+L59SkqUH5kTrEY4RoiM4q3jLe9Fj9XLUUsmRaDx73v2FgqGS:fDUo99dqa5RY4RoP3jLe9FGDxugq
  • TLSH
    T1A9176B07E9A945E8C4AED67589729523BBB17C894B3023DB1F50FA342F72BD05EB9310
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defense_evasiondiscoveryexecutionoverlordpersistenceprivilege_escalationratspywaretrojan

  • Detects Overlord RAT

  • Family: Overlord

    Overlord is an open-source Windows RAT written in Golang.

    ratoverlord
  • Custom signature

    Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers

  • Custom signature

    Detects executables containing URLs to raw contents of a Github gist

  • Command and Scripting Interpreter: PowerShell

    Run Powershell and hide display window.

    execution

  • Modifies Windows Firewall

    defense_evasion

  • Creates a file in the Startup directory

    A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

    persistenceprivilege_escalation

  • Executes dropped EXE

  • Adds Run key to start application

    persistence
  behavioral1behavioral2