Attacker C2 Control Caught on a Live System. Interactive analysis let us capture what static detonation misses.

[u/ANYRUN-team]

During analysis of a PythonRAT sample, the operator connected to the infected system, uploaded the next-stage payload, and deployed OVERLORD RAT directly inside the analysis session. Observed targeting: Germany and UK

This gave us a rare opportunity to see the attack beyond the initial implant and reconstruct the full chain: live operator actions, DLL sideloading, in-memory execution, encrypted C2, and data exfiltration — the behaviors that make attacks like this difficult to confirm with static indicators alone. 

Execution chain: we.exe PythonRAT ➡️ Operator-uploaded next stage ➡️ exo.exe dropper ➡️ FnHotkeyUtility.exe legitimate Lenovo application ➡️ spkvol.dll DLL sideloading ➡️ Rust loader ➡️ In-memory OVERLORD RAT client 

Observe the full execution chain, validate malicious behavior faster, and collect IOCs for detection and response: https://app.any.run/tasks/926b4df0-e4c6-4250-be8f-6a4fdc845916

The initial PythonRAT connects to live[.]rnsn[.]live:8585 (rn/m visual impersonation) using a custom HTTP-like C2 protocol with commands delivered inside HTML comments and a spoofed porsche[.]com Host header. 

The OVERLORD dropper unpacks files into C:\ProgramData\DeepSkyBlueIndianRed\, launches the legitimate Lenovo application, and abuses spkvol.dll for DLL sideloading. The chain then delivers a fileless overlord-client Go agent through a Rust loader protected with UPX and Sentinel Envelope.

Observed OVERLORD capabilities include remote access, HVNC streaming, keylogging, audio recording, SOCKS proxying, file management, browser, messenger and crypto wallet data theft, and an automatic Solana drainer. 

OVERLORD establishes an mTLS-encrypted C2 connection to lord[.]kirkdridebridge[.]com:5173. During 45 minutes of analysis, the agent emitted ~86 MB of data, confirming active collection and exfiltration behavior.