Overlord Agent: Analysis of a Modular Go-Based Post-Compromise Framework (WIP)

Executive Summary

During analysis of a Windows executable recovered from an ongoing malware investigation, researchers identified a previously undocumented Go-based remote access framework internally referenced as Overlord Agent.

The initial infection chain consisted of a Windows batch script containing an embedded Base64-encoded PE payload. Upon execution, the script reconstructs and launches a secondary executable from the user’s temporary directory.

Reverse engineering of the recovered payload revealed a large-scale modular architecture supporting:

• Dynamic plugin loading

• WebAssembly (WASM) execution

• Remote shell access

• Desktop streaming

• Hidden Virtual Network Computing (HVNC)

• Browser profile interaction

• Process injection

• Persistence management

• Infrastructure discovery

• Agent enrollment

• Host identity management

• Self-update functionality

Build metadata recovered from the sample references:

path overlord-client/cmd/agent

suggesting the analyzed binary represents the agent component of a larger client-server ecosystem.

Current evidence indicates the framework was designed for long-term operator-controlled access rather than single-purpose credential theft.

Attribution remains unknown.

Sample Information

Initial Dropper Analysis

The original sample consisted of a Windows batch script containing an embedded Base64-encoded executable.

Recovered launcher logic:

@echo off
setlocal
set “_OVD_SELF=%~f0”

powershell.exe -NoProfile -ExecutionPolicy Bypass -Command ^
“$f=$env:_OVD_SELF;
$l=[IO.File]::ReadAllLines($f);
…
$b=[Convert]::FromBase64String(…);
$t=[IO.Path]::Combine([IO.Path]::GetTempPath(),[Guid]::NewGuid().ToString()+’.exe’);
[IO.File]::WriteAllBytes($t,$b);
Start-Process $t;”

The script reconstructs the embedded payload, writes it to a randomly generated filename within the temporary directory, and launches it using PowerShell.

No external payload retrieval stage was identified.

Build Metadata

Recovered metadata:

path overlord-client/cmd/agent
mod overlord-client (devel)

-tags=overlord_winre
-tags=persist_startup
-tags=persist_registry

The recovered build tags indicate support for multiple persistence mechanisms.

The project structure strongly suggests a client-server architecture.

Architecture Overview

Current analysis indicates the framework is organized around the following major subsystems:

• Agent Core

• Configuration Management

• Identity Management

• Infrastructure Discovery

• Enrollment System

• WebSocket Communications

• Plugin Framework

• Native DLL Execution

• WebAssembly Runtime

• Remote Shell System

• Desktop Streaming Engine

• HVNC Framework

• Browser Operations

• Surveillance Components

• File Management

• Persistence Framework

• Agent Update System

• Process Injection Components

Infrastructure Discovery & C2 Resilience

Confidence: Very High

Recovered artifacts:

RawServerListURL

main.tryRefreshServerList
main.refreshServerList
main.shouldRefreshServerList

config/server_index.json

OVERLORD_SOL_ADDRESS

Current evidence suggests the agent supports dynamic retrieval and refresh of infrastructure information.

The presence of dedicated server refresh logic indicates operators may rotate command-and-control infrastructure independently of agent deployment.

This significantly increases operational resilience compared to hardcoded infrastructure.

Enrollment System

Confidence: Very High

Recovered artifacts:

enrollment_status

enrollment_challenge

main.enrollmentRetryDelay

OVERLORD_AGENT_TOKEN

OVERLORD_TLS_CLIENT_CERT

Current evidence suggests agents must complete an enrollment process before entering normal operational state.

Retry logic indicates enrollment failures are automatically handled.

Host Identity Management

Confidence: High

Recovered artifacts:

overlord-client/cmd/agent/config.deriveHWID

HWID

json:”hwid”

[identity] WARNING: no OS-specific machine ID available, using HWID-only derivation

The agent derives a persistent host identifier for tracking and enrollment purposes.

Fallback logic suggests identity generation remains functional even when platform-specific identifiers are unavailable.

Plugin Framework

Confidence: Very High

Recovered artifacts:

PluginOnLoad

PluginOnUnload

PluginSetCallback

plugin_event

command_result

The framework contains a mature event-driven plugin architecture.

Evidence indicates plugins can be loaded and managed independently from the core agent.

WebAssembly Runtime

Confidence: Very High

Recovered artifacts:

plugins.wasmPlugin

plugins.wasmStatus

plugins.wasmFileStat

empty wasm plugin module

wasm memory write failed

Additional strings reference the Wazero runtime and WASM execution infrastructure.

Current evidence indicates operators can extend functionality through WebAssembly modules without replacing the primary agent binary.

Remote Shell Functionality

Confidence: Very High

Recovered artifacts:

runtime.detectShell

runtime.startRawShell

runtime.startPty

ConsoleHub

ConsoleSession

These artifacts strongly indicate support for fully interactive shell operations.

Presence of PTY functionality suggests support for interactive operator sessions rather than simple command execution.

Desktop Streaming

Confidence: High

Recovered artifacts:

desktop_request_keyframe

desktop: start requested

desktop: stopping stream

OVERLORD_DESKTOP_MAX_FPS

Current evidence indicates support for real-time desktop streaming.

Hidden Virtual Desktop (HVNC)

Confidence: Very High

Recovered artifacts:

hvnc: browser availability check requested

hvnc: installed apps enumeration requested

hvnc: start requested

hvnc_enable_mouse

hvnc_enable_keyboard

CreateDesktopW

OpenDesktopW

SetThreadDesktop

hvnc inject: ReflectiveLoader at offset

hvnc patch: verification mismatch

The framework contains extensive hidden desktop functionality enabling operators to interact with isolated desktop sessions.

Browser Operations

Confidence: Very High

Observed browser references:

Chrome

Edge

Firefox

Brave

Opera

Opera GX

Arc

Vivaldi

Waterfox

Recovered artifacts:

profile clone failed: %v

local extension settings

IndexedDB

Session Storage

Extension Storage

Browser Profiles

Current evidence indicates extensive browser interaction capabilities including profile management and storage access.

Surveillance Capabilities

Confidence: High

Recovered artifacts:

clipboard_sync_start

[keylogger] Starting keylogger

GetAsyncKeyState

GetKeyboardState

webcam stream

webcam_devices

Current evidence indicates support for:

• Keyboard monitoring

• Clipboard collection

• Webcam interaction

• User activity monitoring

Behavioral validation remains pending.

Persistence Framework

Confidence: Very High

Recovered build tags:

persist_registry

persist_startup

Recovered symbols indicate both Registry and Startup-based persistence mechanisms.

Current evidence suggests persistence is implemented as a dedicated subsystem rather than ad-hoc installation logic.

Process Injection & In-Memory Execution

Confidence: Very High

Recovered artifacts:

ReflectiveLoader

RDI_DLL_SECTION

RDI_SEARCH_PATH

RDI_REPLACE_PATH

CreateRemoteThread

WriteProcessMemory

VirtualAllocEx

DLL injection failed: %v

These artifacts indicate support for reflective DLL loading and remote process manipulation.

Agent Update System

Confidence: High

Recovered artifacts:

agent_update[win]: target equals running executable, using deferred updater for %q

Current evidence indicates support for self-updating agents.

This functionality would allow operators to deploy new versions without manual reinstallation.

Command & Control Indicators

Recovered artifacts:

WebSocket

Sec-WebSocket-Key

sessionId

commandId

x-agent-token

x-overlord-client-id

wss://127.0.0.1:5173

OVERLORD_AGENT_TOKEN

OVERLORD_TLS_CA

Current evidence suggests command-and-control communications rely on persistent WebSocket connections.

The localhost endpoint likely represents development or testing infrastructure.

Recovered Artifacts

Build Metadata

path overlord-client/cmd/agent
mod overlord-client (devel)

-tags=overlord_winre
-tags=persist_startup
-tags=persist_registry

Infrastructure Discovery

RawServerListURL

main.tryRefreshServerList

main.refreshServerList

main.shouldRefreshServerList

config/server_index.json

OVERLORD_SOL_ADDRESS

Enrollment

enrollment_status

enrollment_challenge

main.enrollmentRetryDelay

OVERLORD_AGENT_TOKEN

OVERLORD_TLS_CLIENT_CERT

Identity

overlord-client/cmd/agent/config.deriveHWID

HWID

json:”hwid”

Remote Shell

runtime.detectShell

runtime.startRawShell

runtime.startPty

ConsoleHub

ConsoleSession

HVNC

hvnc_enable_mouse

hvnc_enable_keyboard

CreateDesktopW

OpenDesktopW

SetThreadDesktop

Injection

ReflectiveLoader

RDI_DLL_SECTION

CreateRemoteThread

WriteProcessMemory

VirtualAllocEx

WASM

plugins.wasmPlugin

plugins.wasmStatus

plugins.wasmFileStat

Communications

WebSocket

Sec-WebSocket-Key

x-agent-token

sessionId

commandId

Current Assessment

Based on recovered functionality, Overlord Agent appears to be a comprehensive post-compromise operations platform rather than a traditional commodity RAT.

Recovered capabilities demonstrate support for:

• Dynamic infrastructure discovery

• Agent enrollment workflows

• Persistent host identity management

• Interactive remote shell access

• Plugin execution

• WebAssembly extensions

• Desktop streaming

• HVNC operations

• Browser profile manipulation

• Surveillance functions

• Process injection

• Agent self-updating

• Multiple persistence mechanisms

The overall architecture reflects a modular and extensible framework designed for long-term operator control and infrastructure flexibility.

Analysis remains ongoing.

Updated Notes

Solana-Based Infrastructure Discovery

Confidence: Very High

Analysis identified extensive Solana-related functionality that appears tied to infrastructure discovery and failover operations.

Recovered Artifacts

OVERLORD_SERVER_SOL
OVERLORD_SOL_ADDRESS
OVERLORD_SOL_RPC_ENDPOINTS

getSignaturesForAddress
transaction not found
invalid base64 memo
solana address is empty
no solana RPC endpoints configured

Retrying Solana memo lookup in %s

Failover enabled with %d servers

raw server list URL is empty

Assessment

Current evidence strongly suggests Overlord supports retrieving infrastructure information from the Solana blockchain.

The presence of:

getSignaturesForAddress
invalid base64 memo
Retrying Solana memo lookup

indicates the framework may inspect transaction metadata or memo fields associated with a configured Solana address.

Combined with:

OVERLORD_SERVER_SOL
OVERLORD_SOL_ADDRESS
OVERLORD_SOL_RPC_ENDPOINTS

this suggests operators can distribute infrastructure information through blockchain-hosted data rather than relying exclusively on traditional command-and-control infrastructure.

This mechanism would provide resilience against infrastructure takedowns and allow server rotation without agent redeployment.

Enrollment & Challenge Authentication

Confidence: Very High

Analysis identified a dedicated enrollment and challenge-response authentication mechanism internally referred to as “purgatory.”

Recovered artifacts:

enrollment_status
enrollment_challenge

main.enrollmentRetryDelay
main.getEnrollmentRetryInterval

OVERLORD_AGENT_TOKEN
OVERLORD_TLS_CLIENT_CERT

[purgatory] signed challenge nonce (%d bytes)

[purgatory] approved, proceeding with session

[purgatory] legacy server (no challenge), proceeding

purgatory: empty nonce in challenge

purgatory: failed to decode challenge

purgatory: unexpected response type

Assessment

Current evidence suggests agents perform an enrollment process before entering normal operation.

The recovered challenge-response artifacts indicate the framework may require cryptographic validation of agent identity prior to establishing an operational session.

The presence of legacy compatibility handling suggests the framework has undergone multiple development iterations.

WebSocket Communications

Confidence: High

Recovered artifacts:

WebSocket

Sec-WebSocket-Key

x-agent-token

sessionId
commandId

%s/api/clients/%s/stream/ws?role=client

failed to generate Sec-WebSocket-Key: %w

expected handshake response status code

Assessment

Analysis identified a dedicated WebSocket communication channel used for persistent client-server communications.

The recovered URI format suggests communication sessions are associated with unique client identifiers and may be used for real-time command execution, streaming, and plugin management.

Plugin Delivery Infrastructure

Confidence: High

Recovered artifacts:

plugin load http

[plugin] loaded %s (runtime=%s, freeable=%v)

invalid plugin pull url

unsupported plugin pull scheme

no server url configured for plugin pull

plugin_event

Assessment

Current evidence suggests plugin functionality may be delivered dynamically after enrollment.

Combined with the previously identified WASM subsystem, these findings indicate the framework supports modular expansion without requiring redeployment of the primary agent binary.

Agent Update System

Confidence: High

Recovered artifacts:

agent_update[win]: deferred updater launched

failed to launch updated agent: %w

failed to replace executable at %s: %w

missing update path

Assessment

The framework contains dedicated self-update functionality designed to replace deployed agent binaries while maintaining persistence and operational continuity.

Infrastructure Resilience

Confidence: High

Recovered artifacts:

switching to next server [%d/%d]: %s

No server URLs configured. Fetching raw list from %s

raw server list returned no valid URLs

failed to save server index

Assessment

The framework appears designed to tolerate infrastructure failures through automatic server rotation and configuration refresh mechanisms.

This behavior is more consistent with a mature remote administration platform than a simple commodity malware family.