MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 cef5ccaf5b002f4eb5ff29edc2a3b8e53a1c1aaa7489389161bf9ed25575a911. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry

OverlordRAT

Vendor detections: 10

Intelligence 10 IOCs YARA 6 File information Comments

SHA256 hash:	cef5ccaf5b002f4eb5ff29edc2a3b8e53a1c1aaa7489389161bf9ed25575a911
SHA3-384 hash:	318a650cd7439582d3d069e2473c850c5380b4c46c3dcf0c0ba1c8f8277f3fdfb2c2160a0b4ab283e89517f02e87f978
SHA1 hash:	c7138d9027ed0f7ff9f00606731d88bb7293adb0
MD5 hash:	4d046ee5a3ae9d162197a04c7b14d681
humanhash:	illinois-potato-seven-artist
File name:	oxide-stub.exe
Download:	download sample
Signature	OverlordRAT Create hunting rule
File size:	9'338'880 bytes
First seen:	2026-09-24 18:10:22 UTC
Last seen:	Never
File type:	exe
MIME type:	application/x-dosexec
imphash	9bb57ff8e1dd5c675d257f596c23845f (1 x OverlordRAT)
ssdeep	196608:gP5WwmDLLv2Qk2ucNYlaPA0m5evUV8Q6AxlGR/:gIBDLLlkv0m0U+Q6Axla/
TLSH	T1D4963340724915F8F67B56BC6D801A83A7B6B4052733AAFF3AD513E91F229D04E36B34
TrID	29.5% (.EXE) Win64 Executable (generic) (6522/11/2) 22.8% (.EXE) Win16 NE executable (generic) (5038/12/1) 20.3% (.EXE) Win32 Executable (generic) (4504/4/1) 9.1% (.EXE) OS/2 Executable (generic) (2029/13) 9.0% (.EXE) Generic Win/DOS Executable (2002/3)
Magika	pebin
Reporter	NyxIndius
Tags:	ClickFix exe overlord OverlordRAT RAT

Intelligence

File Origin

# of uploads :

# of downloads :

152

Origin country :

Vendor Threat Intelligence

No detections

Malware family:

n/a

ID:

File name:

exe

Verdict:

Malicious activity

Analysis date:

2026-09-24 20:22:54 UTC

Tags:

overlord rat

Link:

https://app.any.run/tasks/4d6f01ee-be34-466b-a2bf-22b5afb54aef

Note:

ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample

Detection:

n/a

Link:

https://www.capesandbox.com/analysis/88851/

Result

Verdict:

Clean

Maliciousness:

Behaviour

Сreating synchronization primitives

Creating a file

Creating a process from a recently created file

Verdict:

Likely Malicious

Threat level:

7.5/10

Confidence:

100%

Tags:

anti-debug anti-vm packed rust

Link:

https://www.filescan.io/uploads/6ab567c74c318e1b6ee4e143/reports/8da37da0-721f-4606-8121-e55275ff3fac/overview

Verdict:

Malicious

Labled as:

Tedy.Generic

Link:

https://www.hybrid-analysis.com/sample/cef5ccaf5b002f4eb5ff29edc2a3b8e53a1c1aaa7489389161bf9ed25575a911

Verdict:

Malicious

File Type:

exe x64

First seen:

2026-05-02T16:10:00Z UTC

Last seen:

2026-05-03T14:47:00Z UTC

Hits:

~10

Link:

https://opentip.kaspersky.com/cef5ccaf5b002f4eb5ff29edc2a3b8e53a1c1aaa7489389161bf9ed25575a911/results?tab=lookup

Verdict:

Malicious

Link:

https://analyze.intezer.com/analyses/8dfc6088-23ae-42e0-b473-b7347e88846f

Score:

86%

Verdict:

Malware

File Type:

Link:

https://malprob.io/report/cef5ccaf5b002f4eb5ff29edc2a3b8e53a1c1aaa7489389161bf9ed25575a911

Verdict:

inconclusive

YARA:

4 match(es)

Tags:

Executable PDB Path PE (Portable Executable) PE File Layout Win 64 Exe x64

Link:

https://app.malva.re/file/4d046ee5a3ae9d162197a04c7b14d681

Detection:

n/a

Link:

https://mwdb.cert.pl/sample/cef5ccaf5b002f4eb5ff29edc2a3b8e53a1c1aaa7489389161bf9ed25575a911/

Threat name:

Win64.Trojan.Tedy

Status:

Malicious

First seen:

2026-05-02 21:05:52 UTC

File Type:

PE+ (Exe)

Extracted files:

AV detection:

18 of 36 (50.00%)

Threat level:

5/5

Detection(s):

Suspicious file

Link:

https://check.spamhaus.org/check/?searchterm=z324zl23aaxu5np7fhw4fi5y4u5bygvkosetrelbx6pnevlvveiq._file

Result

Malware family:

overlord

Score:

10/10

Tags:

family:overlord defense_evasion persistence privilege_escalation rat

Link:

https://tria.ge/reports/260924-wsp94ssxey/

Behaviour

Modifies registry class

Suspicious behavior: EnumeratesProcesses

Suspicious behavior: MapViewOfSection

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Deletes itself

Event Triggered Execution: Component Object Model Hijacking

Executes dropped EXE

Detects Overlord RAT

Family: Overlord

Unpacked files

SH256 hash:

cef5ccaf5b002f4eb5ff29edc2a3b8e53a1c1aaa7489389161bf9ed25575a911

MD5 hash:

4d046ee5a3ae9d162197a04c7b14d681

SHA1 hash:

c7138d9027ed0f7ff9f00606731d88bb7293adb0

Link:

https://www.unpac.me/results/06d0c496-29ff-4a3b-bfe4-0328fe263cfe/

Malware family:

OverlordRAT

Verdict:

Malicious

Link:

https://www.vmray.com/analyses/_mb/cef5ccaf5b00/report/overview.html

Please note that we are no longer able to provide a coverage score for Virus Total.

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:	DebuggerCheck__API Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	golang_bin_JCorn_CSC846 Create hunting rule
Author:	Justin Cornwell
Description:	CSC-846 Golang detection ruleset

Rule name:	pe_detect_tls_callbacks Create hunting rule

Rule name:	ProgramLanguage_Rust Create hunting rule
Author:	albertzsigovits
Description:	Application written in Rust programming language

Rule name:	SEH__vectored Create hunting rule
Reference:	https://github.com/naxonez/yaraRules/blob/master/AntiDebugging.yara

Rule name:	TH_AntiVM_MassHunt_Win_Malware_2026_CYFARE Create hunting rule
Author:	CYFARE
Description:	Detects Windows malware employing anti-VM / anti-sandbox evasion techniques across VMware, VirtualBox, Hyper-V, QEMU, Xen, and generic sandbox environments
Reference:	https://cyfare.net/