overlord | 2026-11-10_e9f711f5029f1300ab606d27ab60bb6c_coinminer_dosia_glassworm_icedid_poet-rat_quasar-rat

Sharing

Copy URL Twitter E-mail

General

Target
2026-11-10_e9f711f5029f1300ab606d27ab60bb6c_coinminer_dosia_glassworm_icedid_poet-rat_quasar-rat
Size 18.4MB
Sample261111-t3a7tsae94
SHA256 234fb4fa09005c996f8174d958410fa9c480bd9dc395552d3a1603f357bedbf6
MD5 e9f711f5029f1300ab606d27ab60bb6c
SHA1 342450a37bb5b63a1843db2c9d6ede45e0784cfb
SHA512 e95207cf96df0d9e01c45ca2669eb70ccf48aea09967ee38e0979c76ebe4ae232d76a511a08423002f6e7f4a0b494ec456c537fc25ff801550f47f3c30838c8d
SSDEEP 98304:fr/na0Z0fnXNW8+L59SkqUH5kTrEY4RoiM4q3jLe9Fj9XLUUsmRaDx73v2FgqGS:fDUo99dqa5RY4RoP3jLe9FGDxugq
TLSH
T1A9176B07E9A945E8C4AED67589729523BBB17C894B3023DB1F50FA342F72BD05EB9310
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

rat overlord

Malware Config

Extracted

Family

overlord

https://gist.githubusercontent.com/recoverfitter-ux/ffc17316df9376ae3803333055657d4b/raw/gistfile1.txt

Extracted

Family

overlord

https://gist.githubusercontent.com/recoverfitter-ux/ffc17316df9376ae3803333055657d4b/raw/gistfile1.txt

Signatures

Family: Overlord
Overlord is an open-source Windows RAT written in Golang.
rat overlord

Detects Overlord RAT 1 IoCs

resource	yara_rule
sample	family_overlord

Custom signature

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Custom signature

Detects executables containing URLs to raw contents of a Github gist 1 IoCs

resource	yara_rule
sample	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
2026-11-10_e9f711f5029f1300ab606d27ab60bb6c_coinminer_dosia_glassworm_icedid_poet-rat_quasar-rat

File Explorer

2026-11-10_e9f711f5029f1300ab606d27ab60bb6c_coinminer_dosia_glassworm_icedid_poet-rat_quasar-rat

.exe 18.4MB

2026-11-10_e9f711f5029f1300ab606d27ab60bb6c_coinminer_dosia_glassworm_icedid_poet-rat_quasar-rat

IMPHASH ea0e89e155e80ef58564110a5beff45b
SHA256 234fb4fa09005c996f8174d958410fa9c480bd9dc395552d3a1603f357bedbf6
MD5 e9f711f5029f1300ab606d27ab60bb6c
SHA1 342450a37bb5b63a1843db2c9d6ede45e0784cfb
SHA512 e95207cf96df0d9e01c45ca2669eb70ccf48aea09967ee38e0979c76ebe4ae232d76a511a08423002f6e7f4a0b494ec456c537fc25ff801550f47f3c30838c8d
SSDEEP 98304:fr/na0Z0fnXNW8+L59SkqUH5kTrEY4RoiM4q3jLe9Fj9XLUUsmRaDx73v2FgqGS:fDUo99dqa5RY4RoP3jLe9FGDxugq
TLSH
T1A9176B07E9A945E8C4AED67589729523BBB17C894B3023DB1F50FA342F72BD05EB9310
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects Overlord RAT
Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers
Detects executables containing URLs to raw contents of a Github gist
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

5184

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LINE_NUMS_STRIPPED IMAGE_FILE_LOCAL_SYMS_STRIPPED IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

d3d11

D3D11CreateDevice

kernel32

AddVectoredContinueHandler AddVectoredExceptionHandler CloseHandle CreateEventA CreateFileA CreateFileW CreateIoCompletionPort CreateSemaphoreA CreateThread CreateWaitableTimerExW DeleteCriticalSection DuplicateHandle EnterCriticalSection ExitProcess FormatMessageA FreeEnvironmentStringsW FreeLibrary GetCPInfo GetConsoleMode GetCurrentProcess GetCurrentProcessId GetCurrentThread GetCurrentThreadId GetEnvironmentStringsW GetErrorMode GetFileInformationByHandle GetLastError GetModuleHandleA GetProcAddress GetProcessAffinityMask GetQueuedCompletionStatusEx GetStdHandle GetSystemDirectoryA GetSystemInfo GetSystemTimeAsFileTime GetThreadContext GetThreadPriority GetTickCount GetTimeZoneInformation InitializeCriticalSection LeaveCriticalSection LoadLibraryA LoadLibraryExW LoadLibraryW LocalFree MultiByteToWideChar OpenProcess OutputDebugStringA PostQueuedCompletionStatus QueryPerformanceCounter QueryPerformanceFrequency RaiseException RaiseFailFastException ReadFile ReleaseSemaphore ResetEvent ResumeThread RtlCaptureContext RtlLookupFunctionEntry RtlUnwindEx RtlVirtualUnwind SetConsoleCtrlHandler SetErrorMode SetEvent SetLastError SetProcessAffinityMask SetProcessPriorityBoost SetThreadContext SetThreadPriority SetUnhandledExceptionFilter SetWaitableTimer Sleep SuspendThread SwitchToThread TlsAlloc TlsGetValue TlsSetValue TryEnterCriticalSection VirtualAlloc VirtualFree VirtualProtect VirtualQuery WaitForMultipleObjects WaitForSingleObject WerGetFlags WerSetFlags WideCharToMultiByte WriteConsoleW WriteFile __C_specific_handler

msvcrt

_assert ___lc_codepage_func ___mb_cur_max_func __getmainargs __initenv __iob_func __set_app_type __setusermatherr _amsg_exit _beginthreadex _cexit _commode _endthreadex _errno _fmode _initterm _lock _setjmp _setmode _unlock _vscprintf _vsnprintf _wfopen abort atexit calloc exit fclose fflush fopen fprintf fputc fread free fseek ftell fwrite getenv ldexp localeconv longjmp malloc memchr memcmp memcpy memmove memset realloc setvbuf signal strchr strcmp strerror strlen strncmp strncpy strtoul vfprintf wcslen _stricmp _strdup _read _fileno

ole32

CoTaskMemFree

Name

.text

Size

7.3MB

Virtual Size

7.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.data

Size

788KB

Virtual Size

788KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rdata

Size

9.9MB

Virtual Size

9.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.pdata

Size

185KB

Virtual Size

185KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

26KB

Virtual Size

26KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.bss

Size

Virtual Size

33.0MB

Characteristics

IMAGE_SCN_CNT_UNINITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.edata

Size

512B

Virtual Size

124B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

6KB

Virtual Size

5KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.tls

Size

512B

Virtual Size

32B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

2KB

Virtual Size

2KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

138KB

Virtual Size

138KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Extracted

Extracted

Signatures

File Explorer

2026-11-10_e9f711f5029f1300ab606d27ab60bb6c_coinminer_dosia_glassworm_icedid_poet-rat_quasar-rat

d3d11

kernel32

msvcrt

ole32

generic