overlord-windows-stock[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
overlord-windows-stock.zip
Size 504KB
Sample261113-pewfmsbt31
SHA256 3c0ca1c0cea6eca9750a1d3203f6d0e4d2c4f0a199aeeca4aa56664db9a7c2f4
MD5 495eb8eee1819cb5731ecb89c66b1334
SHA1 3f402a1875161a6a5f9327aa6031d3fbb6f7b16f
SHA512 862175de4dc3a5d701c0abb83414db0667afe5600f8987e4ced0d712a9fd9e34fb757a48560c36635456d296157eae94abf08a9731044b5298df9fa32d0f85ec
SSDEEP 12288:gB58eq43ySaPcjzmNKeXO/4KLINEJ2kRZ/eC0wxNY8D:kHbCnInQOc+w6xN
TLSH
T13FB42360388B4DEB9D3469C48557855DB1B1F270A436A8E8803C88EF2F8F531976BB7D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/overlord-windows-amd64.exe

File Explorer

overlord-windows-stock.zip

.zip 504KB
README.txt

494B
agent.py

.sh .js 106KB
overlord-windows-amd64.exe

.exe 1.1MB

overlord-windows-stock.zip

SHA256 3c0ca1c0cea6eca9750a1d3203f6d0e4d2c4f0a199aeeca4aa56664db9a7c2f4
MD5 495eb8eee1819cb5731ecb89c66b1334
SHA1 3f402a1875161a6a5f9327aa6031d3fbb6f7b16f
SHA512 862175de4dc3a5d701c0abb83414db0667afe5600f8987e4ced0d712a9fd9e34fb757a48560c36635456d296157eae94abf08a9731044b5298df9fa32d0f85ec
SSDEEP 12288:gB58eq43ySaPcjzmNKeXO/4KLINEJ2kRZ/eC0wxNY8D:kHbCnInQOc+w6xN
TLSH
T13FB42360388B4DEB9D3469C48557855DB1B1F270A436A8E8803C88EF2F8F531976BB7D
MD5 SHA1 SHA512 SSDEEP TLSH

overlord-windows-amd64.exe

SHA256 dec9edd39c92c70df486bcf9591a30d16e26ba7eb61a63020049c5994cdbeca2
MD5 de8ca172b08688b9bc2f20410d48523e
SHA1 a139b565da434bd7b26033cc7f11f65aed849d27
SHA512 d86dcfc5aa549e8750e2a37232ff9f258eba95931dc6c8ce5cfa4ee58e79d3987de990738e489559652b06bc7b1f98df9a756c502210de1e05c3248685e05b55
SSDEEP 12288:1JYhX206T40ULUrC86OZAjeIwjN5nLJJqBNy71nsM+jh0X66GEQDNZCot:jYv6rUwu85ZtrN5nMM+jh0XeNZT
TLSH
T18635F857ACA541B8C4FEE534CA26A113BDA23C580B3537D32FA0B6641FB6FD066B9740
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

439776

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

918KB

Virtual Size

918KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

1016KB

Virtual Size

1015KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

174KB

Virtual Size

721KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

24KB

Virtual Size

24KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

17KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

overlord-windows-stock.zip

README.txt

agent.py

overlord-windows-amd64.exe

generic