MB-329cb3582506bc7b7da039b4f75ea2a2ccdb45f8b8ad6817fd52fbe2e975b0e8
high
📛 Threat Title
OverlordRAT: pg.exe
Description
File type: exe. Size: 12068352 bytes. Tags: download-windows-update-live, dropped-by-Stealc, exe, OverlordRAT. Reporter: iamaachum. First seen: 2026-08-04 19:50:34.
Indicators of Compromise (3)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
hash_sha256
329cb3582506bc7b7da039b4f75ea2a2ccdb45f8b8ad6817fd52fbe2e975b0e8
IOC database
- Type
- hash_sha256
- Value
329cb3582506bc7b7da039b4f75ea2a2ccdb45f8b8ad6817fd52fbe2e975b0e8- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- OverlordRAT
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_sha1
fc957170cafa2c8b35acefd858ec2530b52a407f
IOC database
- Type
- hash_sha1
- Value
fc957170cafa2c8b35acefd858ec2530b52a407f- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
hash_md5
cbb907d008c300b1ba66d760d71263a8
IOC database
- Type
- hash_md5
- Value
cbb907d008c300b1ba66d760d71263a8- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (1)
-
MalwareBazaar sample page
Abuse.ch
File type: exe. Size: 12068352 bytes. Tags: download-windows-update-live, dropped-by-Stealc, exe, OverlordRAT. Reporter: iamaachum. First seen: 2026-08-04 19:50:34.
Remediations (10)
-
web:bazaar.abuse.ch
OverlordRAT malware samples MalwareBazaar Database MalwareBazaar tries to identify the malware family (signature) of submitted malware samples. A malware sample can be associated with only one malware family. The page below gives you an overview on malware samples that MalwareBazaar has identified as OverlordRAT . Database Entry
-
web:bazaar.abuse.ch
Information on OverlordRAT malware sample (SHA256 9a1b80b37fbaff0e30ce1666b4a7cb8db864eb4247f09fd45ed1a63ae353a784) MalwareBazaar uses YARA rules from several public ...
-
web:github.com
Contribute to l6cv/ OverlordRAT development by creating an account on GitHub.
-
web:github.com
Overlord. Contribute to vxaboveground/Overlord development by creating an account on GitHub.
-
web:learn.microsoft.com
Learn how to deal with unwanted mitigations in Windows Security, including a process to remove all mitigations and import a baseline configuration file instead.
-
web:panorays.com
Discover the difference between remediation and mitigation in risk management and how each strategy impacts security and resilience.
-
web:socprime.com
Summary RoguePlanet is a local privilege escalation zero-day that abuses the Microsoft Defender quarantine and remediation workflow on Windows. By combining NTFS directory junctions, opportunistic locks, and the Volume Shadow Copy service, a low-privileged user can interfere with Defender's handling process and force arbitrary code execution as NT AUTHORITY\SYSTEM. The exploit relies on a ...
-
web:urlhaus.abuse.ch
URLhaus tries to identify the malware associated with the payload served by a certain malware URL. In case URLhaus is able to identify the associated malware family, the payload will be tagged accordingly (field signature). The page below gives you an overview on payloads that URLhaus has identified as OverlordRAT .
-
web:www.linkedin.com
The DLL finally injects its payload to werfault.exe, decrypts the final stage Overlord RAT payload with XOR (0xA9) and executes it.
-
web:www.microsoft.com
Understand how this virus or malware spreads and how its payloads affects your computer. Protect against this threat, identify symptoms, and clean up or remove infections.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.