TF-2013273
high
📛 Threat Title
Overlord RAT: SHA1 hash of a malware sample (payload) 6eb0a80b9f97768fc3b5b3ab99ef8a72c5982664
Description
Indicator that identifies a malware sample (payload). IOC type: SHA1 hash of a malware sample (payload). Attributed malware: Overlord RAT. Confidence: 95. First seen: 2026-11-03 16:42:26 UTC. Reporter: Grim.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
hash_sha1
6eb0a80b9f97768fc3b5b3ab99ef8a72c5982664
IOC database
- Type
- hash_sha1
- Value
6eb0a80b9f97768fc3b5b3ab99ef8a72c5982664- First seen
- Last seen
- Attached to this threat
- Appears in
- 2 threats
- Description
- SHA1 hash of a malware sample (payload) attributed to Overlord RAT
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (2)
- Malpedia profile Threatfox IOCs/Threats
-
ThreatFox IOC page
Threatfox IOCs/Threats
Indicator that identifies a malware sample (payload). IOC type: SHA1 hash of a malware sample (payload). Attributed malware: Overlord RAT. Confidence: 95. First seen: 2026-11-03 16:42:26 UTC. Reporter: Grim.
Remediations (10)
-
web:any.run
Overlord RAT is a cross-platform RAT framework supporting Windows, Linux, and macOS, with encrypted C2 communication and multiple persistence capabilities.
-
web:bazaar.abuse.ch
Malware samples associated with tag RAT MalwareBazaar Database Samples on MalwareBazaar are usually associated with certain tags. Every sample can associated with one or more tags. Using tags, it is easy to navigate through the huge amount of malware samples in the MalwareBazaar corpus. The page below gives you an overview on malware samples that are tagged with RAT . Database Entry
-
web:imalware.com
It compares a file's fingerprint (its MD5, SHA-1 or SHA-256 hash ) with a list of fingerprints of known malware . If the hash matches, the file is identical to a known malicious sample .
-
web:inventivehq.com
Check any file hash in seconds. Paste an MD5, SHA-1 or SHA-256 hash , or drop a file to hash it locally, then check it against live malware feeds.
-
web:ismalicious.com
Overlord RAT sample 07283c6791efd28cba1a3b67d3741488099fdd08e0afd6a1f185cf6157a18b02: listed by 2 threat sources ( malware , c2). File type, signatures, hashes, reports.
-
web:ismalicious.com
Overlord RAT sample 20541efb895ad4079d4dbd7234c661c15b77d67085d67a0582a1b80fa093c16b: listed by 2 threat sources ( malware , c2). File type, signatures, hashes, reports.
-
web:threatfox.abuse.ch
Overlord RAT IOC: a4e92203d12dba0319d421f67b6a07934e5495a7 ( sha1_hash ) You are viewing the ThreatFox database entry for sha1_hash ...
-
web:threatfox.abuse.ch
Overlord RAT IOC: f609394cb065f651b68b29352f1538a4ce19627c ( sha1_hash ) You are viewing the ThreatFox database entry for sha1_hash ...
-
web:urlhaus.abuse.ch
URLhaus tries to identify the malware associated with the payload served by a certain malware URL. In case URLhaus is able to identify the associated malware family, the payload will be tagged accordingly (field signature).
-
web:www.iru.com
Overlord RAT is an open-source, cross-platform Remote Access Trojan ( RAT ) delivered via a fake Zoom installer. A .NET downloader disguised as Zoom drops a garble-obfuscated Go agent that communicates over encrypted WebSockets, granting operators full remote control of the compromised device.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.