Skip to main content

Overlord RAT

Malware Family

472 indicators of compromise attributed to Overlord RAT across abuse.ch threat intelligence feeds.

Domains

8

IPs

219

URLs

99

Hashes

146

Download indicators

Indicator lists for this family. Free and anonymous downloads are a 10% sample. This family is filed under two spellings, and each spelling has its own lists: the counts above are their union, an indicator in both counted once.

For continuous updates, the same IOCs ship in the STIX/TAXII threat feed, ready for OpenCTI and MISP.

Threat types

Botnet C&CpayloadPayload Delivery

Sample indicators

IndicatorType
pinkfriend.topdomain
dallas.baltos.onlinedomain
icro-soft.comdomain
hoteljune2026.blogspot.comdomain
contididit.conti.pkdomain
expirience.icudomain
fileserver.devin-hk.shopdomain
server.tocher33.onlinedomain
37.221.64.248ip
136.0.213.106ip
116.118.4.198ip
78.153.149.82ip
158.173.1.148ip
70.34.198.54ip
74.208.117.130ip
45.94.31.227ip
51.195.44.171ip
91.92.240.238ip
95.31.217.8ip
64.89.160.20ip
64.83.33.240ip
209.38.132.165ip
64.89.163.63ip
74.208.16.124ip
192.109.200.22ip
192.3.16.34ip
93.127.141.23ip
209.99.189.121ip
https://80.71.235.62/url
https://signindat.com/url
https://193.26.115.45/url
https://31.7.63.12/url
https://41.212.28.86/url
https://www.larpingcarpet.xyz/url
https://66.154.103.144/url
https://memesensecracked.xyz/url
https://116.118.4.198/url
https://67.9.20.12/url
https://esrpalco.com/url
https://overlord.milky1337.ru/url
https://dilumara.fun/url
https://zoomai.online/url
https://176.96.138.130/url
https://cheater-scanner.com/url
https://185.254.99.58/url
https://mail.strawxom.org/url
https://91.208.206.83/url
https://peakoverlord.duckdns.org/url
f5d7af12fce73bee5c05d02fac6b2f3b26363134hash
d9636241120eb6b38a28e010dc70fa01hash
213c343ab852a0b185a2198677bf48ac0e7372467cce84d813fe8c5ddc7464b7hash
2bf00f24a13a469845f8b2244e8d58dfba02ab31hash
2d9adcb653a222351652077abc838e027fa814f120741c7fb4f14d71d03f9fa0hash
a4e92203d12dba0319d421f67b6a07934e5495a7hash
dc9ca98f5da7e48d1a334a46f7669660hash
158d509a9285fec1ba5569dc40e76d69195d7e2bhash
f99db7a12ab80b11c3fdec7bf6688e3f6a8d028fe07de01d5fd8fc5d5ac8a577hash
15a4fc6c055faab1a1fee79d5e53bdb34ce4ab6631ff6110f46aeaa74a3a6f3dhash
6aa664be33472a61158a7904be971ad7e21980e3hash
07283c6791efd28cba1a3b67d3741488099fdd08e0afd6a1f185cf6157a18b02hash

Another file to check? Run a file hash reputation check.