MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 bc1f4aced516d10f5cfcd5663fa9b94c34f81d9a19cb391034f920de09617a8b. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

OverlordRAT

Vendor detections: 11

Intelligence 11 IOCs YARA 6 File information Comments

SHA256 hash:	bc1f4aced516d10f5cfcd5663fa9b94c34f81d9a19cb391034f920de09617a8b
SHA3-384 hash:	5c406b8976debfea8adbf8f646d725accb29986fcf15c4e5612d13ba7de9090a2a77895e8a3c88b158c571693bab9f65
SHA1 hash:	193a752427c3d7270b677b7be3248030d10a9006
MD5 hash:	f44b817cc0264f3b4d971e1b8359422d
humanhash:	edward-kentucky-pizza-oxygen
File name:	BTMOB.exe
Download:	download sample
Signature	OverlordRAT Create hunting rule
File size:	24'940'323 bytes
First seen:	2026-10-05 14:09:06 UTC
Last seen:	Never
File type:	exe
MIME type:	application/vnd.microsoft.portable-executable
imphash	f34d5f2d4577ed6d9ceec516c1f5a744 (49'308 x AgentTesla, 20'722 x Formbook, 12'402 x SnakeKeylogger)
ssdeep	393216:b2VWKeebAxWGcL2KXOLSBSAbiWL+guvMQ5HjWQdNcmrk/q3lqNIT2IH7rjfQcAKP:b2Voev2K64BOU+giMQ5t/cbS4Nc2In2O
TLSH	T1C247332F7623FE53CDA4F1348A2C00F6E60790FEA91FF305186077224E52ABA66557D9
TrID	70.4% (.EXE) Generic CIL Executable (.NET, Mono, etc.) (73123/4/13) 6.3% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2) 6.2% (.EXE) Win64 Executable (generic) (6522/11/2) 4.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 4.3% (.EXE) Win32 Executable (generic) (4504/4/1)
Magika	pebin
dhash icon	cbcbb4b8d9cbc700 (1 x OverlordRAT)
Reporter	z3r3n0x
Tags:	exe OverlordRAT

Intelligence

File Origin

# of uploads :

# of downloads :

200

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

n/a

ID:

File name:

exe

Verdict:

No threats detected

Analysis date:

2026-10-05 14:20:32 UTC

Tags:

n/a

Link:

https://app.any.run/tasks/71199bfd-e871-4caa-a45d-f60fda6ab6ea

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/90723/

Detection(s):

SecuriteInfo.com.Trojan.Inject7.3395.12805.17616.UNOFFICIAL

Verdict:

Malicious

Score:

99.9%

Link:

https://cyber-fortress.com/docs/result/index.php?id=6acf7cf4f4e17c78f71517e3

Tags:

vmdetect autorun emotet

Result

Verdict:

Malware

Maliciousness:

Behaviour

Creating a file

Creating a process from a recently created file

Searching for synchronization primitives

Creating a file in the %AppData% subdirectories

Moving a file to the %AppData% subdirectory

Сreating synchronization primitives

Connection attempt

Launching the default Windows debugger (dwwin.exe)

Unauthorized injection to a recently created process

Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch

Enabling autorun by creating a file

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

adaptive-context dropper installer-heuristic overlay packed packed

Link:

https://www.filescan.io/uploads/6ac3af91fb98670febd8ac1f/reports/4a8a4d66-a1a2-4892-bb3e-39072b51b8b9/overview

Verdict:

Malicious

Labled as:

Win/malicious_confidence_90%

Link:

https://www.hybrid-analysis.com/sample/bc1f4aced516d10f5cfcd5663fa9b94c34f81d9a19cb391034f920de09617a8b

Verdict:

Malicious

File Type:

exe x32

First seen:

2026-09-20T01:35:00Z UTC

Last seen:

2026-10-06T19:47:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/bc1f4aced516d10f5cfcd5663fa9b94c34f81d9a19cb391034f920de09617a8b/results?tab=lookup

Score:

99%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/bc1f4aced516d10f5cfcd5663fa9b94c34f81d9a19cb391034f920de09617a8b

Gathering data

Threat name:

Win32.Trojan.Generic

Status:

Suspicious

First seen:

2026-09-20 06:26:42 UTC

File Type:

PE (.Net Exe)

Extracted files:

AV detection:

16 of 24 (66.67%)

Threat level:

5/5

Detection(s):

Malicious file

Link:

https://check.spamhaus.org/check/?searchterm=xqpuvtwvc3iq6xh42vtd7knzjq2pqhm2dhftsebu7eqn4clbpkfq._file

Verdict:

malicious

Label(s):

OverlordRAT

Link:

https://reports.threatray.com/bbb3dbc9-5883-4062-af64-3cdf1b91bf4b

Result

Malware family:

overlord

Score:

10/10

Tags:

family:btmob_win family:overlord persistence privilege_escalation rat

Link:

https://tria.ge/reports/261005-rhd2wahc43/

Behaviour

Suspicious use of WriteProcessMemory

Enumerates physical storage devices

Adds Run key to start application

Checks computer location settings

Creates a file in the Startup directory

Executes dropped EXE

Detects BTMOB RAT

Family: BTMOB

Family: Overlord

Malware Config

C2 Extraction:

162.35.96.43:5173

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	NET Create hunting rule
Author:	malware-lu

Rule name:	NETexecutableMicrosoft Create hunting rule
Author:	malware-lu

Rule name:	pe_imphash Create hunting rule

Rule name:	Skystars_Malware_Imphash Create hunting rule
Author:	Skystars LightDefender
Description:	imphash

Rule name:	Sus_CMD_Powershell_Usage Create hunting rule
Author:	XiAnzheng
Description:	May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

Rule name:	WIN_Malware_Unknown_ForgeAuto_6717780a_Extrait Create hunting rule
Author:	Marjoriefort
Description:	Detects Unknown (pe, etat extrait)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Cape

https://www.capesandbox.com/analysis/90723/

Comments

Login required

You need to login to in order to write a comment. Login with your abuse.ch account.

No comments found for this malware sample