Overlord-RAT-Reverse-Engineering-a-Go-Based-RAT-Injection-Keylogging-C2-Exfiltration-Analysis

1. HTTP/2 C2 Channel & Encrypted Screen Capture

Process Hacker's memory string scan of the Overlord RAT (PID 7488) reveals a large set of Windows API calls and internal strings resolved at runtime. Among these, http2dialCall stands out as an HTTP/2-based callback routine used to establish C2 communication. The presence of crypto, input-capture, and graphics-related APIs indicates a fully-featured RAT with keylogging, screen capture, and encrypted C2 capabilities.

Key Observations:

http2dialCall – HTTP/2 callback function; used to open the C2 channel over HTTP/2 (port 443), blending with legitimate HTTPS traffic. http2clientConnPool – Connection pool for HTTP/2 C2 sessions; enables persistent, multiplexed communication with the C2 server. maxIdleConnsPerHost / GetEvictionPriority / SetEvictionPriority – Connection lifecycle management, keeps idle C2 channels alive while evading timeouts. CreateCryptoSession /GetEncryptionBltKey – DirectX/GPU-based crypto session creation; used for encrypted screen capture or GPU-accelerated operations. capture._Ctype_int / capture.monCapture / capture.scaledPart / capture.mfActivate – Screen capture and desktop monitoring routines. GetInputCurrentType / GetImmediateContext – Input and rendering context retrieval; supports keylogging and screen scraping. CreateTrueColorCondition – Display condition setup for screen capture operations.

Why This Matters:

HTTP/2 C2: Using http2dialCall and http2clientConnPool shows the RAT communicates over HTTP/2, which is harder to detect than plain HTTP and blends with modern web traffic. Encrypted Exfiltration: CreateCryptoSession and GetEncryptionBltKey indicate encrypted data transfer, likely for stolen files or screenshots. Full RAT Capability: Screen capture (capture.) + input capture (GetInputCurrentType) = keylogging and remote surveillance. Living-off-the-Land Style: Runtime resolution of API strings (obfuscated storage) is a common evasion technique to defeat static string analysis. Persistence & Evasion: Connection pool management (maxIdleConnsPerHost, GetEvictionPriority) keeps C2 channels stable while avoiding detection.

Visual Reference:

2.WebSocket C2 Fallback & Keylogging Capabilities

A second string scan of the same Overlord RAT process,reveals a distinct set of strings related to input capture, WebSocket C2, and memory/reflection manipulation. Unlike the first set which focused on HTTP/2 and screen capture, this set points to keylogging, persistent WebSocket communication, and in-memory execution techniques.

Key Observations:

capture.rawWin – Raw window capture routine; used for screenshotting active windows. captureKeyStrokes – Direct keylogging function; captures every keystroke typed on the victim machine. map[uintptr]bool – Runtime map structure; likely used to track hooked APIs or captured handles. websocket.noCopy / websocket.header / websocket.opcode – WebSocket implementation strings; indicate the RAT uses WebSocket as a secondary C2 channel (in addition to HTTP/2). writeFramePayload/ readCloseFrameErr / setCloseErrLocked – WebSocket frame handling; confirms active WebSocket-based C2 communication. reflectlite.Type / abi.UncommonType/ abi.PCLnTabMagic – Go runtime reflection/ABI strings; indicate the payload is a Go-based binary using reflection. msgpack.isZeroer / msgpack.field – MessagePack serialization; used to pack/unpack C2 messages efficiently. sync.poolDequeue / poolLocalInternal – Go sync pool management; used for high-performance memory reuse.

Why This Matters:

Dual C2 Channels: HTTP/2 (http2dialCall) + WebSocket (websocket.) = redundant C2 with automatic failover if one channel is blocked. Keylogging Capability: captureKeyStrokes confirms the RAT performs active keystroke capture — credentials, chats, and passwords are at risk. Go-Based Payload: reflectlite, abi.PCLnTabMagic, and msgpack strings reveal this is a Go-compiled RAT, which is harder to reverse and often bypasses AV signatures. MessagePack Serialization: msgpack. indicates compact binary C2 messaging, reducing network footprint and evading DPI. In-Memory Reflection: *reflectlite.Type and *abi.UncommonType are used for dynamic function resolution — a common evasion to avoid static imports. Stealthy WebSocket C2: WebSocket traffic over port 443 blends with legitimate web apps, making detection by network monitoring harder.

Visual Reference:

3.Binary Ninja – Keylogger Module & Agent Command Strings

The dumped binary connectstart.bin (extracted from the Process Hacker memory strings of the Overlord RAT process) was loaded into Binary Ninja for static analysis. The string view reveals a fully structured keylogger module embedded in the payload, along with a clear agent command namespace (overlord-client/cmd/agent/keylogger.*). This confirms that Overlord RAT ships with a modular agent architecture where the keylogger is a dedicated subsystem controlled via C2 commands.

Key Observations:

Module Path: overlord-client/cmd/agent/keylogger.* – clear Go package namespace for the keylogger agent. (Keylogger).Start/ .Stop – starts and stops the keylogger on C2 command. (Keylogger).IsRunning – checks if the keylogger is already active. (Keylogger).captureLoop – main loop that continuously captures keystrokes. (*Keylogger).logKey – raw keystroke capture function. (Keylogger).getWindowTitle – grabs the active window title (context for each keystroke). (Keylogger).flushBuffer / .flushLoop / .FlushNow – periodic flushing of captured keystrokes to disk or C2. (Keylogger).ListFiles / .ReadFile / .DeleteFile / .ClearAll (Keylogger).rotateFile / .cleanupOldLogs – log rotation and cleanup to avoid detection.

Why This Matters:

Modular Agent Architecture: The overlord-client/cmd/agent/ path shows a clean, modular Go agent — each capability (keylogger, screen capture, shell, etc.) is a separate command module. Active Keylogging: captureLoop, logKey, and getWindowTitle confirm real-time keystroke capture with window context (usernames, passwords, chats). Anti-Forensics: rotateFile, cleanupOldLogs, and DeleteFile prevent log accumulation and reduce forensic traces. Evasion via ROT13: rot13 string shows captured data is obfuscated before storage/exfiltration to defeat string-based detection. Permission Gating: NeedsPermissionGate / RequestPermission suggest the RAT verifies environment conditions (UAC, admin rights) before activating the keylogger. Command-Driven Behavior: Start/Stop/IsRunning prove the keylogger is remotely toggled by the C2 — not auto-run, which reduces detection footprint.

Visual Reference:

4.Binary Ninja – Browser Injection & Process Manipulation Module