MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 4320692c3d8740441eddb60c5fece7d15cb5fbb8ca1e4eb7199745223459878a. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

OverlordRAT

Vendor detections: 15

Intelligence 15 IOCs YARA 37 File information Comments

SHA256 hash:	4320692c3d8740441eddb60c5fece7d15cb5fbb8ca1e4eb7199745223459878a
SHA3-384 hash:	d6ca1919eb38664c9d07187f51f2cfe1d56b8d988a9c615bbc940e5d3704666caa2aa53c57e9ae9f90f1491746da7f7b
SHA1 hash:	16e4d95d0537841dcd4e94b69d0dee567c1d8e1e
MD5 hash:	d0fd58a876d5987c6ea93fcacb5e4b99
humanhash:	neptune-yankee-may-michigan
File name:	file
Download:	download sample
Signature	OverlordRAT Create hunting rule
File size:	13'491'200 bytes
First seen:	2026-07-20 11:07:54 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	ad5b7eeb902875ee72ed20bca26b0360 (1 x OverlordRAT)
ssdeep	98304:ND5rEfOlJlc/yCEfVGPT/5LEc7xC/09XLUUs2R2Dqi1Mu3XudjM:NVGOlJjGPTRYc7xC/3DqPj
TLSH	T1A3D64947EC6955E8C1ADD1358666D6227B317C4A0B3173E32B60F6287F32BD0AEB9350
TrID	45.6% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5) 18.0% (.EXE) Win64 Executable (generic) (6522/11/2) 13.9% (.EXE) Win16 NE executable (generic) (5038/12/1) 5.6% (.ICL) Windows Icons Library (generic) (2059/9) 5.6% (.EXE) OS/2 Executable (generic) (2029/13)
Magika	pebin
Reporter	abuse_ch
Tags:	exe OverlordRAT upx-dec

abuse_ch

UPX decompressed file, sourced from SHA256 90694c0795f6100a78cd641568e2ed07f17b2ed6d20d5fcb52c1f5b5b4f99e78

UPX unpacked

This file is the unpacked version of a file that has been packed with UPX. Below is furhter information about the parent (compressed) file.

File size (compressed) :	4'842'496 bytes
File size (de-compressed) :	13'491'200 bytes
Format:	win64/pe
Packed file:	90694c0795f6100a78cd641568e2ed07f17b2ed6d20d5fcb52c1f5b5b4f99e78

Intelligence

File Origin

# of uploads :

# of downloads :

206

Origin country :

Vendor Threat Intelligence

Details

Link:

https://research.acce.ciphertechsolutions.com/results/362af851-33db-4fe2-b381-413e2d1842e1/

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/75428/

Detection(s):

SecuriteInfo.com.Win64.OverlordRAT-A.86577539.UNOFFICIAL

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a5e01be85479d70bfb781da

Tags:

autorun emotet

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

DNS request

Connection attempt

Sending a custom TCP request

Launching a service

Enabling autorun by creating a file

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

anti-debug anti-vm packed

Link:

https://www.filescan.io/uploads/6a5e01b633d19efd891e7ee9/reports/240a58c4-bdcb-4d53-865f-0cc9a089b68c/overview

Verdict:

Malicious

Labled as:

Dump:Generic.Trojan.TangoStealer.Marte.A

Link:

https://www.hybrid-analysis.com/sample/4320692c3d8740441eddb60c5fece7d15cb5fbb8ca1e4eb7199745223459878a

Verdict:

Malicious

File Type:

exe x64

First seen:

2026-07-20T09:50:00Z UTC

Last seen:

2026-07-22T05:31:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/4320692c3d8740441eddb60c5fece7d15cb5fbb8ca1e4eb7199745223459878a/results?tab=lookup

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/2b636891-1cf7-46b9-ba62-f4e421a002c9

Result

Threat name:

GO Agent, Go Keylogger, OverlordAgent

Detection:

malicious

Classification:

troj.adwa.spyw

Score:

100 / 100

Link:

https://www.joesandbox.com/analysis/1945167

Signature

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Drops PE files to the startup folder

Found malware configuration

Joe Sandbox ML detected suspicious sample

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Yara detected GO Agent

Yara detected Go Keylogger

Yara detected Keylogger Generic

Yara detected OverlordAgent

Behaviour

Behavior Graph:

Download SVG

Score:

64%

Verdict:

Susipicious

File Type:

Link:

https://malprob.io/report/4320692c3d8740441eddb60c5fece7d15cb5fbb8ca1e4eb7199745223459878a

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 64 Exe x64

Link:

https://app.malva.re/file/d0fd58a876d5987c6ea93fcacb5e4b99

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/4320692c3d8740441eddb60c5fece7d15cb5fbb8ca1e4eb7199745223459878a/

Threat name:

Win64.Trojan.OverlordRAT

Status:

Malicious

First seen:

2026-07-20 11:09:40 UTC

File Type:

PE+ (Exe)

AV detection:

23 of 38 (60.53%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=imqgslb5q5aeihw5wygf73hh2foll65yzipe5nyzs5csenczq6fa._file

Verdict:

malicious

Label(s):

OverlordRAT

Link:

https://reports.threatray.com/f7aac29e-7306-4880-bfb1-99f2fc579a01

OverlordRAT

90694c0795f6100a78cd641568e2ed07f17b2ed6d20d5fcb52c1f5b5b4f99e78

OverlordRAT

d7e4715e28a7aedea95e35ec98ffc9838f2b39804c71791c573dd2761540d536

OverlordRAT

Result

Malware family:

overlord

Score:

10/10

Tags:

family:overlord rat

Link:

https://tria.ge/reports/260720-m8wbmaas3t/

Behaviour

Checks processor information in registry

Modifies registry class

Suspicious behavior: GetForegroundWindowSpam

Drops startup file

Family: Overlord

Malware Config

C2 Extraction:

panel.tberat-vac.com

Unpacked files

SH256 hash:

4320692c3d8740441eddb60c5fece7d15cb5fbb8ca1e4eb7199745223459878a

MD5 hash:

d0fd58a876d5987c6ea93fcacb5e4b99

SHA1 hash:

16e4d95d0537841dcd4e94b69d0dee567c1d8e1e

Link:

https://www.unpac.me/results/3094b0c6-545f-4d69-b06e-b22fd541558c/

Malware family:

OverlordRAT

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/4320692c3d87/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Malicious File

Score:

1.00

Link:

https://yomi.yoroi.company/submissions/4320692c3d8740441eddb60c5fece7d15cb5fbb8ca1e4eb7199745223459878a

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	command_and_control Create hunting rule
Author:	CD_R0M_
Description:	This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerException__ConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerException__SetConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	DetectGoMethodSignatures Create hunting rule
Author:	Wyatt Tauber
Description:	Detects Go method signatures in unpacked Go binaries

Rule name:	Detect_all_IPv6_variants Create hunting rule
Author:	Bierchermuesli
Description:	Generic IPv6 catcher

Rule name:	Detect_Go_GOMAXPROCS Create hunting rule
Author:	Obscurity Labs LLC
Description:	Detects Go binaries by the presence of runtime.GOMAXPROCS in the runtime metadata

Rule name:	Detect_PowerShell_Obfuscation Create hunting rule
Author:	daniyyell
Description:	Detects obfuscated PowerShell commands commonly used in malicious scripts.

Rule name:	dgaaga Create hunting rule
Author:	Harshit
Description:	Detects suspicious PowerShell or registry activity

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

Rule name:	GoBinTest Create hunting rule

Rule name:	golang Create hunting rule

Rule name:	golang_binary_string Create hunting rule
Description:	Golang strings present

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	Golang_Find_CSC846 Create hunting rule
Author:	Ashar Siddiqui
Description:	Find Go Signatuers

Rule name:	Golang_Find_CSC846_Simple Create hunting rule
Author:	Ashar Siddiqui
Description:	Find Go Signatuers

Rule name:	Go_Malware_Yamux_Variant Create hunting rule
Author:	Gemini
Description:	Detects a specific Go-based malware variant using the yamux library, with shared strings and constants across x86 and ARM architectures.

Rule name:	identity_golang Create hunting rule
Author:	Eric Yocam
Description:	find Golang malware

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	ProgramLanguage_Golang Create hunting rule
Author:	albertzsigovits
Description:	Application written in Golang programming language

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	ReflectiveLoader Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended
Reference:	Internal Research

Rule name:	RemusStealer_GoPayload Create hunting rule
Author:	burger
Description:	Detects RemusStealer Go-compiled payload

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SEH__vectored Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	SHA512_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA384/SHA512 constants

Rule name:	Suspicious_Golang_Binary Create hunting rule
Author:	Tim Machac
Description:	Triage: Golang-compiled binary with suspicious OS/persistence/network strings (not family-specific)

Rule name:	Suspicious_Process Create hunting rule
Author:	Security Research Team
Description:	Suspicious process creation

Rule name:	Sus_All_Windows_PE_Malware Create hunting rule
Author:	DiegoAnalytics
Description:	Detects Windows PE malware of all types, avoids non-executables like .html

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	ThreadControl__Context Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	WIN_WebSocket_Base64_C2_20250726 Create hunting rule
Author:	dogsafetyforeverone
Description:	Detects configuration strings used by malware to specify WebSocket command-and-control endpoints inside Base64-encoded data. It looks for prefixes such as '#ws://' or '#wss://' that were found in QuasarRAT configuration data.