MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 ca029c447aa12fd5e8e91a5debffcdde4cf78151ee15ee13da69200a3cc1663f. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


OverlordRAT


Vendor detections: 12


Intelligence 12 IOCs YARA 3 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: ca029c447aa12fd5e8e91a5debffcdde4cf78151ee15ee13da69200a3cc1663f
SHA3-384 hash: 9a4009e2fe4683f8448a4c3222df84d09642de0c2f3e340cea102351b0b9cde0f785a64e4638690a6aa7893a8aa33ded
SHA1 hash: d0e4300ef05b840b0f36e198eb634b54a917761d
MD5 hash: 861e3af88bf1bcac9caf72bf16fa02b5
humanhash: delaware-failed-july-eleven
File name:FLStudio2025 Crack_patched.exe
Download: download sample
Signature OverlordRAT
Create hunting rule
File size:24'100'352 bytes
First seen:2026-07-21 07:51:40 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
ssdeep 196608:a7Aj+6Y+1fsKPuMMU7U7gHttex1UDOxlgQt6ZqXJTKQ8ayNH7oXiR6KpE+:d+12jRbteD2Oxl6ZqXNKPayNoQ66E
TLSH T127373328DAFE8E26EDF197710C66C23207B19D8F9250E3085AE8DDC3BD2D5B59645233
TrID 44.6% (.EXE) Win64 Executable (generic) (6522/11/2)
14.0% (.ICL) Windows Icons Library (generic) (2059/9)
13.8% (.EXE) OS/2 Executable (generic) (2029/13)
13.7% (.EXE) Generic Win/DOS Executable (2002/3)
13.6% (.EXE) DOS Executable (generic) (2000/1)
Magika pebin
Reporter aachum
Tags:de-pumped download-windows-update-live exe OverlordRAT


Avatar
iamaachum
https://friendihelp.info/

C2: download-windows-update.live (151.243.113.94:5173)

Intelligence

File Origin
# of uploads :
1
# of downloads :
164
Origin country :
ES ES
Vendor Threat Intelligence
No detections
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/75522/
Verdict:
Malicious
Score:
90.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6a5f2559bcffb2c48cb7ade2
Tags:
ransomware shell spawn
Result
Verdict:
Malware
Maliciousness:

Behaviour
Creating a window
Сreating synchronization primitives
Creating a process with a hidden window
Creating a file in the %AppData% directory
Enabling the 'hidden' option for recently created files
Adding an access-denied ACE
Creating a file in the %temp% directory
Unauthorized injection to a recently created process
Restart of the analyzed sample
Creating a file
DNS request
Connection attempt
Sending a custom TCP request
Launching the default Windows debugger (dwwin.exe)
Launching a process
Launching the process to change network settings
Enabling autorun with the standard Software\Microsoft\Windows\CurrentVersion\Run registry branch
Unauthorized injection to a recently created process by asynchronous procedure call
Adding an exclusion to Microsoft Defender
Verdict:
Likely Malicious
Threat level:
  7.5/10
Confidence:
100%
Tags:
overlay packed
Link:
https://www.filescan.io/uploads/6a5f254e3c7691a73834ae3c/reports/19f93670-dd6b-44ea-98dc-00559867bd14/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/ca029c447aa12fd5e8e91a5debffcdde4cf78151ee15ee13da69200a3cc1663f
Verdict:
Malicious
File Type:
exe x64
First seen:
2026-07-21T04:54:00Z UTC
Last seen:
2026-07-21T10:45:00Z UTC
Hits:
~10
Detections:
HEUR:Backdoor.MSIL.XWorm.gen PDM:Trojan.Win32.Generic
Link:
https://opentip.kaspersky.com/ca029c447aa12fd5e8e91a5debffcdde4cf78151ee15ee13da69200a3cc1663f/results?tab=lookup
Result
Threat name:
OverlordAgent
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.expl.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1945715
Signature
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
AI detected malicious Powershell script
Allocates memory in foreign processes
Antivirus detection for URL or domain
Bypasses PowerShell execution policy
Creates a thread in another existing process (thread injection)
Creates an autostart registry key pointing to binary in C:\Windows
Creates autostart registry keys with suspicious values (likely registry only malware)
Creates files with lurking names (e.g. Crack.exe)
Early bird code injection technique detected
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Joe Sandbox ML detected suspicious sample
Loading BitLocker PowerShell Module
Malicious sample detected (through community Yara rule)
Modifies the context of a thread in another process (thread injection)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Queues an APC in another process (thread injection)
Sigma detected: Capture Wi-Fi password
Sigma detected: New RUN Key Pointing to Suspicious Folder
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Script Execution From Temp Folder
Suspicious powershell command line found
Tries to harvest and steal browser information (history, passwords, etc)
Tries to harvest and steal ftp login credentials
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal WLAN passwords
Unusual module load detection (module proxying)
Uses netsh to modify the Windows network and firewall settings
Writes to foreign memory regions
Yara detected OverlordAgent
Yara detected Powershell decode and execute
Yara detected UAC Bypass using CMSTP
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1945715 Sample: FLStudio2025 Crack_patched.exe Startdate: 21/07/2026 Architecture: WINDOWS Score: 100 66 download-windows-update.live 2->66 72 Found malware configuration 2->72 74 Malicious sample detected (through community Yara rule) 2->74 76 Antivirus detection for URL or domain 2->76 78 18 other signatures 2->78 10 FLStudio2025 Crack_patched.exe 1 7 2->10         started        14 powershell.exe 15 2->14         started        16 powershell.exe 2->16         started        signatures3 process4 file5 52 C:\Users\user\AppData\Roaming\JXRpFSUAj.exe, PE32+ 10->52 dropped 54 C:\Users\...\JXRpFSUAj.exe:Zone.Identifier, ASCII 10->54 dropped 56 C:\Users\user\AppData\...\voaw4bfeydv.ps1, ASCII 10->56 dropped 58 C:\...\FLStudio2025 Crack_patched.exe.log, CSV 10->58 dropped 98 Creates autostart registry keys with suspicious values (likely registry only malware) 10->98 100 Creates files with lurking names (e.g. Crack.exe) 10->100 102 Creates an autostart registry key pointing to binary in C:\Windows 10->102 104 3 other signatures 10->104 18 FLStudio2025 Crack_patched.exe 1 10->18         started        22 powershell.exe 23 10->22         started        24 JXRpFSUAj.exe 14->24         started        26 conhost.exe 14->26         started        28 JXRpFSUAj.exe 16->28         started        30 conhost.exe 16->30         started        signatures6 process7 dnsIp8 68 download-windows-update.live 151.243.113.94, 49714, 49715, 5173 DEDIK-IODEDIKSERVICESLIMITEDDEDIKIOGB Germany 18->68 80 Early bird code injection technique detected 18->80 82 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 18->82 84 Found many strings related to Crypto-Wallets (likely being stolen) 18->84 96 7 other signatures 18->96 32 chrome.exe 1 18->32         started        34 netsh.exe 2 18->34         started        36 chrome.exe 18->36 injected 86 Loading BitLocker PowerShell Module 22->86 38 conhost.exe 22->38         started        88 Multi AV Scanner detection for dropped file 24->88 90 Modifies the context of a thread in another process (thread injection) 24->90 92 Injects a PE file into a foreign processes 24->92 94 Unusual module load detection (module proxying) 24->94 40 JXRpFSUAj.exe 24->40         started        42 JXRpFSUAj.exe 28->42         started        signatures9 process10 process11 44 chrome.exe 2 32->44         started        47 conhost.exe 34->47         started        dnsIp12 70 192.168.2.10, 443, 49701, 49707 unknown unknown 44->70 49 chrome.exe 44->49         started        process13 dnsIp14 60 android.l.google.com 142.250.217.14 GOOGLE-GoogleLLCUS United States 49->60 62 www.google.com 142.251.153.119 GOOGLE-GoogleLLCUS United States 49->62 64 5 other IPs or domains 49->64
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/ca029c447aa12fd5e8e91a5debffcdde4cf78151ee15ee13da69200a3cc1663f
Verdict:
inconclusive
YARA:
5 match(es)
Tags:
.Net Executable Managed .NET PE (Portable Executable) PE File Layout SOS: 0.54 Win 64 Exe x64
Link:
https://app.malva.re/file/861e3af88bf1bcac9caf72bf16fa02b5
Gathering data
Threat name:
ByteCode-MSIL.Backdoor.FormBook
Create hunting rule
Status:
Malicious
First seen:
2026-07-21 07:53:49 UTC
File Type:
PE+ (.Net Exe)
Extracted files:
8
AV detection:
20 of 36 (55.56%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=zibjyrd2uex5l2hjdjo6x76n3zgppakr5yk64e62neqaupgbmy7q._file
Verdict:
malicious
Label(s):
GOAWAYBackdoor
Create hunting rule
Link:
https://reports.threatray.com/294d0c5a-30a2-4ec6-9c65-1dba971c0122
Similar samples:
bfbd3504845be773ac87743e73e0234e51ed743e13a76b517ec54d5b8e1322d7
OverlordRAT
Result
Malware family:
n/a
Score:
  8/10
Tags:
discovery execution persistence spyware stealer upx
Link:
https://tria.ge/reports/260721-jqpjksbx7t/
Behaviour
Suspicious use of WriteProcessMemory
Checks processor information in registry
Enumerates system info in registry
Modifies registry class
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
Enumerates physical storage devices
System Network Configuration Discovery: Wi-Fi Discovery
System Time Discovery
SmartAssembly .NET packer
Suspicious use of SetThreadContext
UPX packed file
Adds Run key to start application
Checks computer location settings
Executes dropped EXE
Reads user/profile data of web browsers
Command and Scripting Interpreter: PowerShell
Malware family:
OverlordRAT
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/ca029c447aa1/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:CP_Script_Inject_Detector
Create hunting rule
Author:DiegoAnalytics
Description:Detects attempts to inject code into another process across PE, ELF, Mach-O binaries
Rule name:NET
Create hunting rule
Author:malware-lu
Rule name:pe_no_import_table
Create hunting rule
Description:Detect pe file that no import table

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

OverlordRAT

zip c6856bbd7fdff4f2c068a73fee87f5498f69d5fe4f6caf5370e851811ef70a3a

OverlordRAT

Executable exe ca029c447aa12fd5e8e91a5debffcdde4cf78151ee15ee13da69200a3cc1663f

(this sample)

  
Link
https://tria.ge/260721-h56kzabs4s/behavioral2
  
Dropped by
SHA256 c6856bbd7fdff4f2c068a73fee87f5498f69d5fe4f6caf5370e851811ef70a3a
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/75522/
  
Dropped by
MD5 27addb17de726ba7c3e0938ce1c7063e

Comments