URLhaus-PL-ca7339c4a1cb94be338a91f67568a9ad466c60e49b5369988ee1b3643f31e3ec medium

Description

Malware family: OverlordRAT. File type: exe. Size: 9,338,880 bytes. First seen: 2026-09-25 06:23:17.

Indicators of Compromise (5)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (2)

• Download sample (ZIP, password: infected) URLhaus
• URLhaus payload page URLhaus

• MalwareBazaar | OverlordRAT
  web:bazaar.abuse.ch

  OverlordRAT malware samples MalwareBazaar Database MalwareBazaar tries to identify the malware family (signature) of submitted malware samples. A malware sample can be associated with only one malware family. The page below gives you an overview on malware samples that MalwareBazaar has identified as OverlordRAT . Database Entry

  2026-09-25 10:01 UTC
• MalwareBazaar | SHA256 ...
  web:bazaar.abuse.ch

  The table below shows additional information about this malware sample such as delivery method and external references. Web download OverlordRAT exe b2aa2c5c202e530bb1f8ed9f1c00b4e59be8445455f7eef1b8fb25a2f92408a6 (this sample) Dropped by StealC

  2026-09-25 10:01 UTC
• URLhaus: exe Malicious URLs | SOC Hunt Feed
  web:davidgodwinpratt.com

  Hunt Hypothesis This detection identifies adversary behavior where threat actors distribute executable malware through seven distinct malicious URLs flagged by URLhaus to initiate command-and-control or payload delivery. The SOC team should proactively hunt for these indicators in Azure Sentinel to rapidly isolate compromised endpoints and prevent lateral movement before the executables ...

  2026-09-25 10:01 UTC
• GitHub - abusech/URLhaus: Open platform for sharing malware ...
  web:github.com

  URLhaus is an open platform for sharing malware distribution sites. This repository provides some sample python3 scripts on how to interact with the URLhaus bulk API.

  2026-09-25 10:01 UTC
• GitHub - l6cv/OverlordRAT
  web:github.com

  Contribute to l6cv/ OverlordRAT development by creating an account on GitHub.

  2026-09-25 10:01 UTC
• URLHaus data - 08-08-2026 (Part 3) - LevelBlue - Open Threat Exchange
  web:otx.alienvault.com

  Learn about the latest cyber threats. Research, collaborate, and share threat intelligence in real time. Protect yourself and the community against today's emerging threats.

  2026-09-25 10:01 UTC
• ThreatFox | 432fb29714e78ea2d8e8e907132bc7259d445cb4
  web:threatfox.abuse.ch

  ThreatFox IOC Database You are viewing the ThreatFox database entry for sha1_hash 432fb29714e78ea2d8e8e907132bc7259d445cb4. Database Entry Actions ... Grim Submitted by mal-parse from MalwareBazaar signature OverlordRAT

  2026-09-25 10:01 UTC
• URLhaus | OverlordRAT
  web:urlhaus.abuse.ch

  URLhaus tries to identify the malware associated with the payload served by a certain malware URL. In case URLhaus is able to identify the associated malware family, the payload will be tagged accordingly (field signature). The page below gives you an overview on payloads that URLhaus has identified as OverlordRAT .

  2026-09-25 10:01 UTC
• URLhaus | OverlordRAT
  web:urlhaus.abuse.ch

  URLhaus Database Malware URLs on URLhaus are usually associated with certain tags. Every URL can be associated with one or more tags. Using tags, it is easy to navigate through the huge amount of malware URLs. The page below gives you an overview on malware URLs that are tagged with OverlordRAT . Database Entry

  2026-09-25 10:01 UTC
• CSIRT-IE: Active Malware Distribution Sites
  web:www.ncsc.gov.ie

  CSIRT-IE monitors the URLhaus dataset for reports of sites, within its jurisdiction, that are reported to be actively distributing malware. Active Malware Distribution Sites The URLhaus platform only report sites (URLs) that are directly being used to distribute malware.

  2026-09-25 10:01 UTC

Only Available for Registered Users. Sign in to view.