Known malicious kitcriticalother

Overlord remote-access tool control panels, including the 'TankRat' rebrand

family: overlord-rat-c2-panel-2026-11

Login pages of control panels for Overlord, an open-source remote-access tool whose Windows agent gives the operator live screen control on visible and hidden desktops, keystroke and clipboard capture, file and shell access and a SOCKS relay over a WebSocket channel. The panel's name, logo and colours are configurable. One operator runs it as 'TankRat', a Chinese-language login with an authenticator-code field, behind fake Malaysian tax-notice downloads that side-load a loader into signed Windows programs and fetch the agent from a code-hosting release. A match means a page built from the panel's login template, or a scan of a known panel host such as devin-us[.]com, fileserver.devin-hk[.]shop, viva-glade[.]shop, peelgroup[.]store, yesjob[.]life or cdn.fileserveronlineweb[.]com.

Anchors

Hunting ruleOverlord_RAT_C2_Panel_Login
SMQL queryrun
favicon_hash:1708493336 OR favicon_hash:492611779 OR title:"TankRat" OR contacted_host:devin-us.com OR contacted_host:fileserver.devin-hk.shop OR contacted_host:viva-glade.shop OR contacted_host:peelgroup.store OR contacted_host:yesjob.life OR contacted_host:cdn.fileserveronlineweb.com OR ip:103.59.101.28 OR ip:85.137.60.92 OR ip:176.97.117.181 OR ip:213.111.157.107

Provenance

Added: 2026-11-04 08:41
Rule anchor: the panel's login template (crown card, authenticator-code group, particle animation and its bundled animation library), which survives a change of name, logo and colour. Search anchor: the panel's stock and rebranded favicons, the rebrand's title and the known panel hosts.

Sightings (22)Atom feed

HostScanScriptMatchScanned
cdn.fileserveronlineweb.comcea9eca4…https://cdn.fileserveronlineweb.com/#htmlrule2026-11-04 08:12
cdn.fileserveronlineweb.comcea9eca4…—query2026-11-04 08:12
yesjob.life353543a5…https://yesjob.life/#htmlrule2026-11-04 08:12
yesjob.life353543a5…—query2026-11-04 08:12
peelgroup.storee9a3c298…https://peelgroup.store/#htmlrule2026-11-04 08:12
peelgroup.storee9a3c298…—query2026-11-04 08:12
viva-glade.shopfc949694…https://viva-glade.shop/#htmlrule2026-11-04 08:12
viva-glade.shopfc949694…—query2026-11-04 08:12
fileserver.devin-hk.shopef7d72b8…https://fileserver.devin-hk.shop/#htmlrule2026-11-04 08:12
fileserver.devin-hk.shopef7d72b8…—query2026-11-04 08:12
devin-us.com25dc1018…https://devin-us.com/#htmlrule2026-11-04 08:12
devin-us.com25dc1018…—query2026-11-04 08:12
server.tocher33.online#htmlcb6660cc…https://server.tocher33.online#htmlrule2026-10-28 03:47
server.tocher33.onlinecb6660cc…—query2026-10-28 03:47
fileserver.devin-hk.shop#html8d779c3e…https://fileserver.devin-hk.shop#htmlrule2026-10-14 23:09
fileserver.devin-hk.shop8d779c3e…—query2026-10-14 23:09
checkdomfilellc.usb8125595…https://checkdomfilellc.us/#htmlrule2026-09-17 18:47
checkdomfilellc.usb8125595…—query2026-09-17 18:47
overlord.milky1337.ru53c1b0d4…https://overlord.milky1337.ru/#htmlrule2026-09-14 00:47
overlord.milky1337.ru53c1b0d4…—query2026-09-14 00:47
voltexa.winb0447b5d…https://voltexa.win/#htmlrule2026-09-13 03:47
voltexa.winb0447b5d…—query2026-09-13 03:47