Executive Summary
A recently observed campaign, linked to the threat actor I_H8_KDot, impersonates the Inland Revenue Authority of Singapore (IRAS) to distribute Overlord RAT. The infection chain is notably complex, utilizing a Virtual Hard Disk (VHDX) image to bypass static analysis and deliver multiple malicious components. Once mounted, the victim executes a file that initiates DLL sideloading, leading to the in-memory execution of shellcode generated by the Donut framework.
The Overlord RAT is a feature-rich post-exploitation framework capable of keylogging, credential theft, and remote command execution. The malware incorporates extensive anti-analysis checks, including virtualization detection, debugger enumeration, and runtime XOR string decryption, ensuring the payload only executes on legitimate victim endpoints.
This campaign highlights the continued trend of using native Windows features like VHDX and open-source offensive tooling to reduce forensic footprints. The automation of post-execution cleanup, where the malware unmounts and deletes the VHDX via PowerShell, significantly hinders traditional incident response and recovery efforts.