General
- Target ce97b675a86bfff5e73e218e8d9d17458857d2328b1b55acd87f644001ca865f
- Size 15KB
- Sample261113-wal5qset2s
- SHA256 ce97b675a86bfff5e73e218e8d9d17458857d2328b1b55acd87f644001ca865f
Score
10/10
Malware Config
Targets
-
- Target ce97b675a86bfff5e73e218e8d9d17458857d2328b1b55acd87f644001ca865f
- Size 15KB
- SHA256 ce97b675a86bfff5e73e218e8d9d17458857d2328b1b55acd87f644001ca865f
Score10/10Detects Overlord RAT
Family: Overlord
Overlord is an open-source Windows RAT written in Golang.
Badlisted process makes network request
Network request originating from process or tool commonly abused by malware.
Loads dropped DLL
Adds Run key to start application
Contacts third-party web service commonly abused for C2
Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.
Looks up external IP address via web service
Uses a legitimate IP lookup service to find the infected system's external IP.
Discovers running processes
Running process information can be used to identify security tools or plan follow-on actions.
MITRE ATT&CK Enterprise v16
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Modify Registry
2Subvert Trust Controls
2Install Root Certificate
2