TF-2013285
high
📛 Threat Title
Overlord RAT: MD5 hash of a malware sample (payload) dda172653a16df80bbefa76e8b5ad6f8
Description
Indicator that identifies a malware sample (payload). IOC type: MD5 hash of a malware sample (payload). Attributed malware: Overlord RAT. Confidence: 95. First seen: 2026-11-03 16:42:31 UTC. Reporter: Grim.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
hash_md5
dda172653a16df80bbefa76e8b5ad6f8
IOC database
- Type
- hash_md5
- Value
dda172653a16df80bbefa76e8b5ad6f8- First seen
- Last seen
- Attached to this threat
- Appears in
- 2 threats
- Description
- MD5 hash of a malware sample (payload) attributed to Overlord RAT
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (2)
- Malpedia profile Threatfox IOCs/Threats
-
ThreatFox IOC page
Threatfox IOCs/Threats
Indicator that identifies a malware sample (payload). IOC type: MD5 hash of a malware sample (payload). Attributed malware: Overlord RAT. Confidence: 95. First seen: 2026-11-03 16:42:31 UTC. Reporter: Grim.
Remediations (10)
-
web:any.run
Overlord RAT is a cross-platform RAT framework supporting Windows, Linux, and macOS, with encrypted C2 communication and multiple persistence capabilities.
-
web:github.com
The Cybersight Security Malware Samples repository is a curated collection of malicious software specimens for cybersecurity research and analysis. This repository provides security professionals with real-world samples to study malware behavior, develop detection techniques, and enhance defensive strategies.
-
web:imalware.com
It compares a file's fingerprint (its MD5 , SHA-1 or SHA-256 hash ) with a list of fingerprints of known malware . If the hash matches, the file is identical to a known malicious sample .
-
web:ismalicious.com
Overlord RAT sample 15a4fc6c055faab1a1fee79d5e53bdb34ce4ab6631ff6110f46aeaa74a3a6f3d: listed by 4 threat sources ( malware , c2). File type, signatures, hashes, reports.
-
web:ismalicious.com
Overlord RAT sample 20541efb895ad4079d4dbd7234c661c15b77d67085d67a0582a1b80fa093c16b: listed by 2 threat sources ( malware , c2). File type, signatures, hashes, reports.
-
web:malpedia.caad.fkie.fraunhofer.de
Hi! Malpedia is a free service offered by Fraunhofer FKIE. Administration is lead by Daniel Plohmann and Steffen Enders. Mission Statement The primary goal of Malpedia is to provide a resource for rapid identification and actionable context when investigating malware . Openness to curated contributions shall ensure an accountable level of quality in order to foster meaningful and reproducible ...
-
web:securityarsenal.com
Eight malicious npm packages downloaded 40,767 times are delivering the Overlord RAT and a credential stealer. Developer machines and CI/CD pipelines are the target — here's how to hunt and remediate.
-
web:threatfox.abuse.ch
Overlord RAT IOC: dc9ca98f5da7e48d1a334a46f7669660 ( md5_hash ) You are viewing the ThreatFox database entry for md5_hash dc9ca98f5da7e48d1a334a46f7669660.
-
web:www.iru.com
Overlord RAT is an open-source, cross-platform Remote Access Trojan ( RAT ) delivered via a fake Zoom installer. A .NET downloader disguised as Zoom drops a garble-obfuscated Go agent that communicates over encrypted WebSockets, granting operators full remote control of the compromised device.
-
web:www.team-cymru.com
The Malware Hash Registry is a programmatic hash validation service operated by TeamCymru. Submit an MD5 , SHA-1, or SHA-256 hash via HTTPS, DNS, or WHOIS and get back a near-real-time response showing the last time the sample was seen and the percentage of 30+ antivirus databases that flagged it.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.