MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 90694c0795f6100a78cd641568e2ed07f17b2ed6d20d5fcb52c1f5b5b4f99e78. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

OverlordRAT

Vendor detections: 14

Intelligence 14 IOCs YARA 39 File information Comments

SHA256 hash:	90694c0795f6100a78cd641568e2ed07f17b2ed6d20d5fcb52c1f5b5b4f99e78
SHA3-384 hash:	047e6c55b8729b87c2ae9eea5cce36d1047f665e7ca7dd19a6c2871e0291bc213b56960d9a7ffffccc966455a66d45a7
SHA1 hash:	ec6457fa70a737f9604f2af9a45a2d9bdbe94c2f
MD5 hash:	c74d3a3ce1af76dd8768bd9ad21eada4
humanhash:	snake-one-echo-leopard
File name:	file
Download:	download sample
Signature	OverlordRAT Create hunting rule
File size:	4'842'496 bytes
First seen:	2026-07-20 11:07:26 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	5699e1d42ceaa51c77691cc53baa5841 (1 x OverlordRAT)
ssdeep	49152:bkdCIiOamxHIed+LEzVKZMp/cs/O6SVsbR+A47d10FLTyAJn1VtnDdVBhculmOBs:bkIIzFGEhKZpVyRjc10JJZVjcafReja
TLSH	T14526336270659FB4DA17B07871074A34E2E61A9E227A0415DDFEDE92E33DE0024F786F
TrID	63.5% (.EXE) UPX compressed Win64 Executable (70117/5/12) 24.5% (.EXE) UPX compressed Win32 Executable (27066/9/6) 4.5% (.EXE) Win16 NE executable (generic) (5038/12/1) 1.8% (.ICL) Windows Icons Library (generic) (2059/9) 1.8% (.EXE) OS/2 Executable (generic) (2029/13)
Magika	pebin
Reporter	Bitsight
Tags:	54e64e dropped-by-amadey exe OverlordRAT UPX

Bitsight

url: http://91.92.242.236/files-129312398/files/file_eae4cc343c8e98ac.exe

UPX packed

This file is packed with UPX. We have therefore unpacked the file. Below is furhter information about the unpacked (de-compressed) file.

File size (compressed) :	4'842'496 bytes
File size (de-compressed) :	13'491'200 bytes
Format:	win64/pe
Unpacked file:	4320692c3d8740441eddb60c5fece7d15cb5fbb8ca1e4eb7199745223459878a

Intelligence

File Origin

# of uploads :

# of downloads :

211

Origin country :

Vendor Threat Intelligence

Malware configuration found for:

PEPacker

Details

Link:

https://research.acce.ciphertechsolutions.com/results/570aa6cd-c241-4eaf-8257-55bbb1189d9e/

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/75427/

Detection(s):

SecuriteInfo.com.Win64.OverlordRAT-A.19815624.UNOFFICIAL

Verdict:

Malicious

Score:

97.4%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6a5e017e85479d70bfb781ad

Tags:

autorun emotet

Result

Verdict:

Malware

Maliciousness:

Behaviour

Сreating synchronization primitives

DNS request

Connection attempt

Sending a custom TCP request

Enabling autorun by creating a file

Verdict:

Malicious

Threat level:

10/10

Confidence:

100%

Tags:

anti-debug anti-vm packed packed packed packer upx

Link:

https://www.filescan.io/uploads/6a5e01775b6462da78e0ea66/reports/9b2aa0df-a6c8-44c6-848a-be19e03362cb/overview

Verdict:

Malicious

Labled as:

Dump:Generic.Trojan.TangoStealer.Marte.A

Link:

https://www.hybrid-analysis.com/sample/90694c0795f6100a78cd641568e2ed07f17b2ed6d20d5fcb52c1f5b5b4f99e78

Verdict:

Malicious

File Type:

exe x64

First seen:

2026-07-20T09:50:00Z UTC

Last seen:

2026-07-21T17:38:00Z UTC

Hits:

~100

Link:

https://opentip.kaspersky.com/90694c0795f6100a78cd641568e2ed07f17b2ed6d20d5fcb52c1f5b5b4f99e78/results?tab=lookup

Verdict:

Unknown

Link:

https://analyze.intezer.com/analyses/d934ff2d-1521-4c57-978f-2372dcb77a20

Score:

91%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/90694c0795f6100a78cd641568e2ed07f17b2ed6d20d5fcb52c1f5b5b4f99e78

Verdict:

inconclusive

YARA:

5 match(es)

Tags:

Executable PE (Portable Executable) PE File Layout Win 64 Exe x64

Link:

https://app.malva.re/file/c74d3a3ce1af76dd8768bd9ad21eada4

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/90694c0795f6100a78cd641568e2ed07f17b2ed6d20d5fcb52c1f5b5b4f99e78/

Threat name:

Win64.Trojan.TangoStealerMarte

Status:

Malicious

First seen:

2026-07-20 11:08:54 UTC

File Type:

PE+ (Exe)

Extracted files:

AV detection:

16 of 38 (42.11%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=sbuuyb4v6yiau6gnmqkwryxna7yxwlww2igv7s2syh23lnhztz4a._file

Verdict:

malicious

Label(s):

OverlordRAT

Link:

https://reports.threatray.com/fa3e58df-15a6-4421-92d9-545b8200965d

OverlordRAT

90694c0795f6100a78cd641568e2ed07f17b2ed6d20d5fcb52c1f5b5b4f99e78

OverlordRAT

d7e4715e28a7aedea95e35ec98ffc9838f2b39804c71791c573dd2761540d536

OverlordRAT

Result

Malware family:

overlord

Score:

10/10

Tags:

family:overlord rat upx

Link:

https://tria.ge/reports/260720-m794dsfy3n/

Behaviour

Checks processor information in registry

Modifies registry class

Suspicious behavior: GetForegroundWindowSpam

UPX packed file

Drops startup file

Family: Overlord

Malware Config

C2 Extraction:

panel.tberat-vac.com

Unpacked files

SH256 hash:

90694c0795f6100a78cd641568e2ed07f17b2ed6d20d5fcb52c1f5b5b4f99e78

MD5 hash:

c74d3a3ce1af76dd8768bd9ad21eada4

SHA1 hash:

ec6457fa70a737f9604f2af9a45a2d9bdbe94c2f

Link:

https://www.unpac.me/results/49dcd849-3d6c-4911-84e3-217f521ec10d/

Malware family:

OverlordRAT

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/90694c0795f6/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

Threat name:

Suspicious File

Score:

0.56

Link:

https://yomi.yoroi.company/submissions/90694c0795f6100a78cd641568e2ed07f17b2ed6d20d5fcb52c1f5b5b4f99e78

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	command_and_control Create hunting rule
Author:	CD_R0M_
Description:	This rule searches for common strings found by malware using C2. Based on a sample used by a Ransomware group

Rule name:	CP_Script_Inject_Detector Create hunting rule
Author:	DiegoAnalytics
Description:	Detects attempts to inject code into another process across PE, ELF, Mach-O binaries

Rule name:	DebuggerCheck__QueryInfo Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerException__ConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DebuggerException__SetConsoleCtrl Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	DetectEncryptedVariants Create hunting rule
Author:	Zinyth
Description:	Detects 'encrypted' in ASCII, Unicode, base64, or hex-encoded

Rule name:	DetectGoMethodSignatures Create hunting rule
Author:	Wyatt Tauber
Description:	Detects Go method signatures in unpacked Go binaries

Rule name:	Detect_all_IPv6_variants Create hunting rule
Author:	Bierchermuesli
Description:	Generic IPv6 catcher

Rule name:	Detect_Go_GOMAXPROCS Create hunting rule
Author:	Obscurity Labs LLC
Description:	Detects Go binaries by the presence of runtime.GOMAXPROCS in the runtime metadata

Rule name:	Detect_PowerShell_Obfuscation Create hunting rule
Author:	daniyyell
Description:	Detects obfuscated PowerShell commands commonly used in malicious scripts.

Rule name:	dgaaga Create hunting rule
Author:	Harshit
Description:	Detects suspicious PowerShell or registry activity

Rule name:	FreddyBearDropper Create hunting rule
Author:	Dwarozh Hoshiar
Description:	Freddy Bear Dropper is dropping a malware through base63 encoded powershell scrip.

Rule name:	GoBinTest Create hunting rule

Rule name:	golang Create hunting rule

Rule name:	golang_binary_string Create hunting rule
Description:	Golang strings present

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	Golang_Find_CSC846 Create hunting rule
Author:	Ashar Siddiqui
Description:	Find Go Signatuers

Rule name:	Golang_Find_CSC846_Simple Create hunting rule
Author:	Ashar Siddiqui
Description:	Find Go Signatuers

Rule name:	Go_Malware_Yamux_Variant Create hunting rule
Author:	Gemini
Description:	Detects a specific Go-based malware variant using the yamux library, with shared strings and constants across x86 and ARM architectures.

Rule name:	identity_golang Create hunting rule
Author:	Eric Yocam
Description:	find Golang malware

Rule name:	INDICATOR_SUSPICIOUS_Binary_References_Browsers Create hunting rule
Author:	ditekSHen
Description:	Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers.

Rule name:	MD5_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for MD5 constants

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	ProgramLanguage_Golang Create hunting rule
Author:	albertzsigovits
Description:	Application written in Golang programming language

Rule name:	RANSOMWARE Create hunting rule
Author:	ToroGuitar

Rule name:	ReflectiveLoader Create hunting rule
Author:	Florian Roth (Nextron Systems)
Description:	Detects a unspecified hack tool, crack or malware using a reflective loader - no hard match - further investigation recommended
Reference:	Internal Research

Rule name:	RIPEMD160_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for RIPEMD-160 constants

Rule name:	SEH__vectored Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	SHA1_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA1 constants

Rule name:	SHA512_Constants Create hunting rule
Author:	phoul (@phoul)
Description:	Look for SHA384/SHA512 constants

Rule name:	Suspicious_Golang_Binary Create hunting rule
Author:	Tim Machac
Description:	Triage: Golang-compiled binary with suspicious OS/persistence/network strings (not family-specific)

Rule name:	Suspicious_Process Create hunting rule
Author:	Security Research Team
Description:	Suspicious process creation

Rule name:	Sus_All_Windows_PE_Malware Create hunting rule
Author:	DiegoAnalytics
Description:	Detects Windows PE malware of all types, avoids non-executables like .html

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	telebot_framework Create hunting rule
Author:	vietdx.mb

Rule name:	ThreadControl__Context Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	UPX Create hunting rule
Author:	kevoreilly
Description:	UPX Unpacker: dump on OEP (original entry point)

Rule name:	upx_largefile Create hunting rule
Author:	k3nr9

Rule name:	WIN_WebSocket_Base64_C2_20250726 Create hunting rule
Author:	dogsafetyforeverone
Description:	Detects configuration strings used by malware to specify WebSocket command-and-control endpoints inside Base64-encoded data. It looks for prefixes such as '#ws://' or '#wss://' that were found in QuasarRAT configuration data.