โ Feed
๐จ ๐๐๐๐ฎ๐ฐ๐ธ๐ฒ๐ฟ ๐๐ฎ ๐๐ผ๐ป๐๐ฟ๐ผ๐น ๐๐ฎ๐๐ด๐ต๐ ๐ผ๐ป ๐ฎ ๐๐ถ๐๐ฒ ๐ฆ๐๐๐๐ฒ๐บ. Interactive analysis let us capture what static detonation misses โ ๏ธ
๐ข๐ฏ๐๐ฒ๐ฟ๐๐ฒ๐ฑ ๐๐ฎ๐ฟ๐ด๐ฒ๐๐ถ๐ป๐ด: ๐๐ฒ๐ฟ๐บ๐ฎ๐ป๐ ๐ฎ๐ป๐ฑ ๐จ๐ โ๏ธ The operator connected to the infected system, uploaded the next-stage payload, and triggered a full chain: we.exe PythonRAT โก๏ธ exo.exe dropper โก๏ธ Lenovo FnHotkeyUtility.exe โก๏ธ spkvol.dll sideloading โก๏ธ Rust loader โก๏ธ In-memory OVERLORD RAT.
๐ฅ The initial implant was only the entry point. The real risk appeared later: DLL sideloading, in-memory execution, encrypted C2, and active data exfiltration.
1๏ธโฃ we.exe connects to live[.]rnsn[.]live:8585 (rn/m visual impersonation) using a custom HTTP-like C2 protocol with commands hidden in HTML comments and a spoofed porsche[.]com Host header.
2๏ธโฃ exo.exe unpacks to C:\ProgramData\DeepSkyBlueIndianRed\, launches the legitimate Lenovo binary, sideloads spkvol.dll, and delivers a fileless overlord-client Go agent.
๐ OVERLORD connects to lord[.]kirkdridebridge[.]com:5173 over mTLS-encrypted C2. During 45 minutes of analysis, the agent emitted ~86 MB of data, confirming active collection and exfiltration.
Observed capabilities include remote access, HVNC, keylogging, audio recording, SOCKS proxying, file management, browser/messenger/wallet data theft, and Solana drainer activity.
๐จโ๐ป See the full execution chain and collect #IOCs:
https://app.any.run/tasks/926b4df0-e4c6-4250-be8f-6a4fdc845916/?utm_source=mastodon&utm_medium=post&utm_campaign=pythonrat_overlord&utm_content=linktoservice&utm_term=220726
โก๏ธ Learn how #ANYRUN helps SOC teams detect complex threats early: https://any.run/enterprise/?utm_source=mastodon&utm_medium=post&utm_campaign=pythonrat_overlord&utm_content=linktoenterpriselanding&utm_term=220726
#cybersecurity #infosec
Replies (1)
-
๐ฏ IOCs and behavioral patterns:
Python RAT (Stage 1):
C2: live.rnsn[.]live โ 69.169.111[.]81, TCP 8585
HTTP request markers: GET /International, X-Secret: 12345, Host: www.porsche[.]com, Referer: /|1.1.3
HTTP response decoy markers: Fullscreen Spinner + commands encoded in comment strings
OVERLORD RAT (Stage 2):
C2: lord.kirkdridebridge[.]com โ 163.245.218[.]93, TCP 5173, mTLSv1.3 channel encryption
Host artifacts:
C:\Users\Public\Windows\win32\we.exe
โฆ\run.vbs
โฆ\win6\exo.exe
.cmd
C:\ProgramData\sysid.txt (we.exe bot UUID)
C:\ProgramData\DeepSkyBlueIndianRed\* โ FnHotkeyUtility.exe, spkvol.dll, ludp.dll, msvcp140.dll, vcruntime140*.dll dropped executables
Registry:
HKCU...\Run: SkypeUpd=โฆ\win32\we.exe
HKCU...\Run: Winrarservice=โฆ\win32\run.vbs
Mutexes:
Global\Overlord-1_oVC9y33fSmT7DVUv0HJn9Y (ForestGreenLightSlateGray object)
Inno Setup cmdline password: f1846950-ca2f-4f9b-bd08-4807e431faa9
SHA256:
38cec7299bcbcc334633c87de5ed0d8355df8c73fadd26a8b5ca3862c2ea4357 (we.exe)
6805a1cb9b26b629f94aa3cf062e78eb4a5d259f459c0d8ca5a43cc08b16154b (client1.1.3.pyc)
7f53b7a21ba1418f56afac2f5f9db18bcca48d0c9ab7c3bee15a01db57d5fe5c (exo.exe)
9ab2f85ab539cea0f868c0b2a5219c3a8ccfef5365d74cc2cd455cb06d243f65 (upd.exe)
31c97b6e93112cae7bfce17d5979ccd513111b74165fc6ef471a9f8c821ae879 (spkvol.dll)
๐ MITRE ATT&CK:
T1059 โ Command and Scripting Interpreter
T1105 โ Ingress Tool Transfer
T1547.001 โ Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
T1027 โ Obfuscated Files or Information
T1574.002 โ Hijack Execution Flow: DLL Side-Loading
T1113 โ Screen Capture
T1123 โ Audio Capture
T1056.001 โ Input Capture: Keylogging
T1041 โ Exfiltration Over C2 Channel
Open ##4014282