MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 203af48227a87e5a219bb46ea7cd2fe5959d8d90025a026a67487526658095b6. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

OverlordRAT

Vendor detections: 11

Intelligence 11 IOCs YARA 2 File information Comments

SHA256 hash:	203af48227a87e5a219bb46ea7cd2fe5959d8d90025a026a67487526658095b6
SHA3-384 hash:	b44f07fb126b3846d117e507f9fbb8acbf78412304503122f9c3bc4c936abe037a2a788c17ea81caa7c310e7628e5e25
SHA1 hash:	2bf00f24a13a469845f8b2244e8d58dfba02ab31
MD5 hash:	eb77d1b6d71d1efefe59ca8f1275867f
humanhash:	sink-saturn-charlie-robert
File name:	file
Download:	download sample
Signature	OverlordRAT Create hunting rule
File size:	12'195'328 bytes
First seen:	2026-08-19 08:14:44 UTC
Last seen:	2026-08-19 22:16:25 UTC
File type:	exe
MIME type:	application/x-dosexec
ssdeep	196608:xv3e7VRjRMLM3Edn9RzdQGW1TLR8I+UiYZ2487Vi+/ly2EXqoF2vtENkwpsWRDOY:xv3E+LOEdn3piTLq4GBVi+/lJEq6NkwT
TLSH	T116C6338517A5D80ADC856A325E70CF746E781E87A620C20B6FF03E677F39BB16E15207
TrID	44.6% (.EXE) Win64 Executable (generic) (6522/11/2) 14.0% (.ICL) Windows Icons Library (generic) (2059/9) 13.8% (.EXE) OS/2 Executable (generic) (2029/13) 13.7% (.EXE) Generic Win/DOS Executable (2002/3) 13.6% (.EXE) DOS Executable (generic) (2000/1)
Magika	pebin
Reporter	Bitsight
Tags:	dropped-by-Stealc exe OverlordRAT PG

Bitsight

url: https://crazypianoswebshop.nl/vFRywuNACNkFcQY.exe

Intelligence

File Origin

# of uploads :

# of downloads :

171

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

n/a

ID:

File name:

exe

Verdict:

No threats detected

Analysis date:

2026-08-19 08:26:58 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/5075fd9d-0610-4c7d-a9ce-a579f1813fbf

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/81935/

Detection(s):

SecuriteInfo.com.Win64.MalwareX-gen.49516635.UNOFFICIAL

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a window

Сreating synchronization primitives

Creating a process with a hidden window

Creating a file in the %AppData% directory

Enabling the 'hidden' option for recently created files

Adding an access-denied ACE

Unauthorized injection to a recently created process

Restart of the analyzed sample

Creating a file

DNS request

Connection attempt

Sending a custom TCP request

Launching the default Windows debugger (dwwin.exe)

Launching a process

Reading critical registry keys

Launching the process to change network settings

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Unauthorized injection to a recently created process by asynchronous procedure call

Stealing user critical data

Adding an exclusion to Microsoft Defender

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

packed

Link:

https://www.filescan.io/uploads/6a8566282db4837a74827180/reports/e943971c-3fa8-4a84-8f9e-b5f158e63a63/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_90%

Link:

https://www.hybrid-analysis.com/sample/203af48227a87e5a219bb46ea7cd2fe5959d8d90025a026a67487526658095b6

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/25992ba3-19c2-4131-aeb4-a390ba26a793

Score:

99%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/203af48227a87e5a219bb46ea7cd2fe5959d8d90025a026a67487526658095b6

Verdict:

inconclusive

YARA:

5 match(es)

Tags:

.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.41 Win 64 Exe x64

Link:

https://app.malva.re/file/eb77d1b6d71d1efefe59ca8f1275867f

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/203af48227a87e5a219bb46ea7cd2fe5959d8d90025a026a67487526658095b6/

Threat name:

Win64.Trojan.Gracing

Status:

Malicious

First seen:

2026-08-19 08:15:43 UTC

File Type:

PE+ (.Net Exe)

Extracted files:

AV detection:

21 of 38 (55.26%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=ea5pjarhvb7fuim3wrxkptjp4wkz3dmqajnae2thjb2smzmasw3a._file

Verdict:

malicious

Label(s):

GOAWAYBackdoor

Link:

https://reports.threatray.com/d75db73d-9605-4bbd-8667-f71743bf45ee

Result

Malware family:

overlord

Score:

10/10

Tags:

family:overlord discovery execution persistence rat upx

Link:

https://tria.ge/reports/260819-j5vzxassas/

Behaviour

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

System Network Configuration Discovery: Wi-Fi Discovery

System Time Discovery

Suspicious use of SetThreadContext

UPX packed file

Adds Run key to start application

Checks computer location settings

Executes dropped EXE

Command and Scripting Interpreter: PowerShell

Detects Overlord RAT

Family: Overlord

Unpacked files

SH256 hash:

203af48227a87e5a219bb46ea7cd2fe5959d8d90025a026a67487526658095b6

MD5 hash:

eb77d1b6d71d1efefe59ca8f1275867f

SHA1 hash:

2bf00f24a13a469845f8b2244e8d58dfba02ab31

Link:

https://www.unpac.me/results/a45d0a46-bb54-40ce-b46b-813cbee09673/

Malware family:

OverlordRAT

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/203af48227a8/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/203af48227a87e5a219bb46ea7cd2fe5959d8d90025a026a67487526658095b6

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.