🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 e38d5ff4bf7c6873e23b5ac2f54e68b3c0913e058e8d1da3c2b19077293102df. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


OverlordRAT


Vendor detections: 10


Intelligence 10 IOCs YARA 4 File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: e38d5ff4bf7c6873e23b5ac2f54e68b3c0913e058e8d1da3c2b19077293102df
SHA3-384 hash: e37cde2fae3f9412eba56a7a751f16e14ce64f02dbb4b1131fb433d00d3375d017857b56dd5a02166f306d6b0cd68f09
SHA1 hash: 76ffb745d11add317d13fdfdd88655f40ef80c01
MD5 hash: ac42da4ea8a47039297b496028cc13af
humanhash: butter-carolina-sweet-fruit
File name:agent-windows-amd64-4d34f3bc.bin.delivery.cmd
Download: download sample
Signature OverlordRAT
Create hunting rule
File size:77'939 bytes
First seen:2026-10-02 21:15:54 UTC
Last seen:Never
File type:cmd cmd
MIME type:text/x-msdos-batch
ssdeep 1536:LmFMvQ79Xll08p6t20jNhSyR6jXyH1fdvdUW92ng5bal1:6xllvpBENhSs6jC1fdVUW9Ug5M
TLSH T115735D8C5D863C4F57E19255F7A97BFF1AE9E3F7F1DB128C28052E08029A64891CD08B
Magika batch
Reporter smica83
Tags:cmd OverlordRAT

Intelligence

File Origin
# of uploads :
1
# of downloads :
91
Origin country :
HU HU
Vendor Threat Intelligence
Malware configuration found for:
BatchScript
Details
Link:
https://research.acce.ciphertechsolutions.com/results/638e1e4c-7dd0-4996-8a5e-2ec6f3de1fbb/
Verdict:
Malicious
Score:
94.9%
Link:
https://cyber-fortress.com/docs/result/index.php?id=6acf04e9350c7ee8cc154d5a
Tags:
dropper shell sage
Verdict:
Suspicious
Threat level:
  5/10
Confidence:
100%
Tags:
base64 cmd lolbin masquerade powershell
Link:
https://www.filescan.io/uploads/6ac01f1b7b8adce843f7da24/reports/b197c5b5-abba-4b34-8fac-c03fef11a272/overview
Verdict:
Unknown
Link:
https://www.hybrid-analysis.com/sample/e38d5ff4bf7c6873e23b5ac2f54e68b3c0913e058e8d1da3c2b19077293102df
Verdict:
Malicious
File Type:
unix shell
First seen:
2026-10-02T18:54:00Z UTC
Last seen:
2026-10-04T13:18:00Z UTC
Hits:
~10
Detections:
PDM:Trojan.Win32.Generic HEUR:Trojan.BAT.Alien.gen
Link:
https://opentip.kaspersky.com/e38d5ff4bf7c6873e23b5ac2f54e68b3c0913e058e8d1da3c2b19077293102df/results?tab=lookup
Result
Threat name:
KeyLogger
Create hunting rule
Detection:
malicious
Classification:
spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1981543
Signature
Bypasses PowerShell execution policy
Found direct / indirect Syscall (likely to bypass EDR)
Found pyInstaller with non standard icon
Found suspicious powershell code related to unpacking or dynamic code loading
Joe Sandbox ML detected suspicious sample
Malicious sample detected (through community Yara rule)
Powershell connects to network
Powershell drops PE file
Sigma detected: Base64 Encoded PowerShell Command Detected
Sigma detected: PowerShell Base64 Encoded FromBase64String Cmdlet
Sigma detected: Script Interpreter Execution From Suspicious Folder
Sigma detected: Suspicious Script Execution From Temp Folder
Suspicious powershell command line found
Switches to a custom stack to bypass stack traces
Unusual module load detection (module proxying)
Uses netsh to modify the Windows network and firewall settings
Verifies if a H.264 Video Encoder exists (likely to detect the VM)
Yara detected Keylogger Generic
Yara detected Python Keylogger
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1981543 Sample: agent-windows-amd64-4d34f3b... Startdate: 02/10/2026 Architecture: WINDOWS Score: 100 33 expirience.icu 2->33 37 Malicious sample detected (through community Yara rule) 2->37 39 Yara detected Keylogger Generic 2->39 41 Yara detected Python Keylogger 2->41 43 5 other signatures 2->43 8 cmd.exe 2 2->8         started        signatures3 process4 signatures5 53 Suspicious powershell command line found 8->53 55 Bypasses PowerShell execution policy 8->55 11 powershell.exe 14 38 8->11         started        16 powershell.exe 8 8->16         started        18 conhost.exe 8->18         started        process6 dnsIp7 35 expirience.icu 104.21.77.65, 443, 49716, 49720 CLOUDFLARENET-CloudflareIncUS Canada 11->35 25 C:\Users\user\AppData\...\vcruntime140_1.dll, PE32+ 11->25 dropped 27 C:\Users\user\AppData\...\vcruntime140.dll, PE32+ 11->27 dropped 29 C:\Users\user\AppData\Local\...\select.pyd, PE32+ 11->29 dropped 31 11 other files (10 malicious) 11->31 dropped 57 Powershell connects to network 11->57 20 pythonw.exe 11->20         started        23 netsh.exe 2 11->23         started        59 Uses netsh to modify the Windows network and firewall settings 16->59 61 Found suspicious powershell code related to unpacking or dynamic code loading 16->61 63 Found pyInstaller with non standard icon 16->63 65 Powershell drops PE file 16->65 file8 signatures9 process10 signatures11 45 Verifies if a H.264 Video Encoder exists (likely to detect the VM) 20->45 47 Unusual module load detection (module proxying) 20->47 49 Switches to a custom stack to bypass stack traces 20->49 51 Found direct / indirect Syscall (likely to bypass EDR) 20->51
Score:
94%
Verdict:
Malware
File Type:
SCRIPT
Link:
https://malprob.io/report/e38d5ff4bf7c6873e23b5ac2f54e68b3c0913e058e8d1da3c2b19077293102df
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/e38d5ff4bf7c6873e23b5ac2f54e68b3c0913e058e8d1da3c2b19077293102df/
Threat name:
Text.Trojan.Generic
Create hunting rule
Status:
Suspicious
First seen:
2026-10-02 02:38:27 UTC
File Type:
Text (Batch)
AV detection:
3 of 23 (13.04%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=4ogv75f7pruhhyr3llbpkttiwpajcpqfr2gr3i6cwgihokjralpq._file
Result
Malware family:
donutloader
Create hunting rule
Score:
  10/10
Tags:
family:donutloader discovery execution loader persistence privilege_escalation
Link:
https://tria.ge/reports/261002-z4jhgshf86/
Behaviour
Checks processor information in registry
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Event Triggered Execution: Netsh Helper DLL
Executes a command shell one-liner
Reads the TCP/IP host and domain name from the registry
Command and Scripting Interpreter: PowerShell
Enumerates connected drives
Executes dropped EXE
Loads dropped DLL
Badlisted process makes network request
Detects DonutLoader
Family: DonutLoader
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.00
Link:
https://yomi.yoroi.company/submissions/e38d5ff4bf7c6873e23b5ac2f54e68b3c0913e058e8d1da3c2b19077293102df

YARA Signatures

MalwareBazaar uses YARA rules from several public and non-public repositories, such as YARAhub and Malpedia. Those are being matched against malware samples uploaded to MalwareBazaar as well as against any suspicious process dumps they may create. Please note that only results from TLP:CLEAR rules are being displayed.

Rule name:Base64_Encoded_Powershell_Directives
Create hunting rule
Rule name:obfuscated_BAT
Create hunting rule
Author:@warz_s
Description:Identifies obfuscated BAT files
Reference:https://github.com/secwarz/YaraRules
Rule name:SCRIPT_Dropper_Unknown_ForgeAuto_aaa464f7
Create hunting rule
Author:Marjoriefort
Description:Detects Unknown (script_js, etat binaire)
Rule name:Sus_CMD_Powershell_Usage
Create hunting rule
Author:XiAnzheng
Description:May Contain(Obfuscated or no) Powershell or CMD Command that can be abused by threat actor(can create FP)

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Comments