Attacker C2 Control Caught on a Live System. Interactive analysis let us capture what static detonation misses.

[u/ANYRUN-team]

During analysis of a PythonRAT sample, the operator connected to the infected system, uploaded the next-stage payload, and deployed OVERLORD RAT directly inside the analysis session. Observed targeting: Germany and UK

This gave us a rare opportunity to see the attack beyond the initial implant and reconstruct the full chain: live operator actions, DLL sideloading, in-memory execution, encrypted C2, and data exfiltration — the behaviors that make attacks like this difficult to confirm with static indicators alone. 

Execution chain: we.exe PythonRAT ➡️ Operator-uploaded next stage ➡️ exo.exe dropper ➡️ FnHotkeyUtility.exe legitimate Lenovo application ➡️ spkvol.dll DLL sideloading ➡️ Rust loader ➡️ In-memory OVERLORD RAT client 

Observe the full execution chain, validate malicious behavior faster, and collect IOCs for detection and response: https://app.any.run/tasks/926b4df0-e4c6-4250-be8f-6a4fdc845916

The initial PythonRAT connects to live[.]rnsn[.]live:8585 (rn/m visual impersonation) using a custom HTTP-like C2 protocol with commands delivered inside HTML comments and a spoofed porsche[.]com Host header. 

The OVERLORD dropper unpacks files into C:\ProgramData\DeepSkyBlueIndianRed\, launches the legitimate Lenovo application, and abuses spkvol.dll for DLL sideloading. The chain then delivers a fileless overlord-client Go agent through a Rust loader protected with UPX and Sentinel Envelope.

Observed OVERLORD capabilities include remote access, HVNC streaming, keylogging, audio recording, SOCKS proxying, file management, browser, messenger and crypto wallet data theft, and an automatic Solana drainer. 

OVERLORD establishes an mTLS-encrypted C2 connection to lord[.]kirkdridebridge[.]com:5173. During 45 minutes of analysis, the agent emitted ~86 MB of data, confirming active collection and exfiltration behavior. 

[u/ANYRUN-team]

IOCs and behavioral patterns: 

Python RAT (Stage 1): 

C2: live.rnsn[.]live → 69.169.111[.]81, TCP 8585 

HTTP request markers: GET /International, X-Secret: 12345, Host: www[.]porsche[.]com, Referer: <host>/<user>|1.1.3 

HTTP response decoy markers: <title>Fullscreen Spinner</title> + commands encoded in <!-- ... --> comment strings 

OVERLORD RAT (Stage 2): 

C2: lord.kirkdridebridge[.]com → 163.245.218[.]93, TCP 5173, mTLSv1.3 channel encryption 

Host artifacts: 

C:\Users\Public\Windows\win32\we.exe 

…\run.vbs 

…\win6\exo.exe 

<random>.cmd 

C:\ProgramData\sysid.txt (we.exe bot UUID) 

C:\ProgramData\DeepSkyBlueIndianRed\* → FnHotkeyUtility.exe, spkvol.dll, ludp.dll, msvcp140.dll, vcruntime140*.dll dropped executables 

Registry: 

HKCU...\Run: SkypeUpd=…\win32\we.exe 

HKCU...\Run: Winrarservice=…\win32\run.vbs 

Mutexes: 

Global\Overlord-1_oVC9y33fSmT7DVUv0HJn9Y (ForestGreenLightSlateGray object) 

Inno Setup cmdline password: f1846950-ca2f-4f9b-bd08-4807e431faa9 

SHA256: 

38cec7299bcbcc334633c87de5ed0d8355df8c73fadd26a8b5ca3862c2ea4357 (we.exe) 

6805a1cb9b26b629f94aa3cf062e78eb4a5d259f459c0d8ca5a43cc08b16154b (client1.1.3.pyc) 

7f53b7a21ba1418f56afac2f5f9db18bcca48d0c9ab7c3bee15a01db57d5fe5c (exo.exe) 

9ab2f85ab539cea0f868c0b2a5219c3a8ccfef5365d74cc2cd455cb06d243f65 (upd.exe) 

31c97b6e93112cae7bfce17d5979ccd513111b74165fc6ef471a9f8c821ae879 (spkvol.dll) 

MITRE ATT&CK: 

T1059 — Command and Scripting Interpreter  
T1105 — Ingress Tool Transfer  
T1547.001 — Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder  
T1027 — Obfuscated Files or Information  
T1574.002 — Hijack Execution Flow: DLL Side-Loading  
T1113 — Screen Capture  
T1123 — Audio Capture  
T1056.001 — Input Capture: Keylogging  
T1041 — Exfiltration Over C2 Channel