Skip to main content

Overlord RAT

Malware Family

364 indicators of compromise attributed to Overlord RAT across abuse.ch threat intelligence feeds.

Domains

6

IPs

218

URLs

97

Hashes

43

Download indicators

Indicator lists for this family. Free and anonymous downloads are a 10% sample.

Domains (6)IPs (218)URLs (97)Hashes (43)

Need continuous updates instead of static lists? The same IOCs ship in the STIX/TAXII threat feed, ready for OpenCTI and MISP.

Threat types

Botnet C&CpayloadPayload Delivery

Sample indicators

IndicatorType
pinkfriend.topdomain
dallas.baltos.onlinedomain
icro-soft.comdomain
hoteljune2026.blogspot.comdomain
contididit.conti.pkdomain
expirience.icudomain
185.254.99.169ip
80.71.235.41ip
193.233.82.121ip
203.159.90.80ip
104.197.0.198ip
185.172.65.33ip
107.175.115.123ip
193.181.213.156ip
94.154.32.157ip
167.71.242.108ip
45.137.20.129ip
135.181.68.20ip
45.141.116.254ip
185.62.56.207ip
88.87.85.199ip
54.38.153.252ip
80.71.235.62ip
212.113.119.206ip
64.89.160.253ip
143.20.99.86ip
https://www.wibbyzap.xyz/url
https://zoomai.online/url
https://www.eclypse-system-pc.co/url
https://tapsend.city/url
https://over.casacam.net/url
https://ifclmarkets.com/url
https://nttsw.cdn-support.com/url
https://aotools.duckdns.org/url
https://80.71.235.62/url
https://80.85.146.244/url
https://66.154.103.144/url
https://45.90.98.139/url
https://2.59.135.182/url
https://197.237.214.209/url
https://198.37.119.55/url
https://193.181.213.156/url
https://144.172.115.45/url
https://104.197.0.198/url
https://135.181.128.187/url
http://64.89.163.63/u.ps1url
432fb29714e78ea2d8e8e907132bc7259d445cb4hash
8d6c14f5304f7882d5280a39595ef5a6hash
f5d7af12fce73bee5c05d02fac6b2f3b26363134hash
ac1f8b34486eabbb9ae6c3880a4b57dbf044cbfcc7f103ab3c93ed4f26285c3bhash
d9636241120eb6b38a28e010dc70fa01hash
213c343ab852a0b185a2198677bf48ac0e7372467cce84d813fe8c5ddc7464b7hash
f609394cb065f651b68b29352f1538a4ce19627chash
2bf00f24a13a469845f8b2244e8d58dfba02ab31hash
f89cad44baf7b71f0546119d74f45d1bhash
1e3980e87f5c0baa0514e6e6338cbc15hash
4f3c97948a9cd189f0c75c7f604dbc675b3d59b1daf197424464a24c3b8e4617hash
f2bc1f451548fadcaa799ab9d46782bahash
158d509a9285fec1ba5569dc40e76d69195d7e2bhash
e6f0059933f463ddbac645d710bf92f0hash

Another file to check? Run a file hash reputation check.