RAT
ngrok
ngrok is a tunneling / reverse-proxy service frequently abused for remote access and C2 concealment. More operational detail is tracked in LOTTunnels. ANY.RUN documented Overlord RAT routing encrypted WSS C2 through an ngrok tunnel (hostname pattern *.ngrok... to 3.124.142.205:443) in its October 2026 Overlord write-up.
Tool overview
- Category
- RAT
- Research authors
- Jose Hernandez
- Created
- 2024-07-19
- Last modified
- 2026-10-05
- Privileges
- Not recorded
- Free / availability
- Not recorded
- Verification required
- Not recorded
- Supported platforms
- Not recorded
Executables & installation paths
- Filename
- Not recorded
- OriginalFileName
- Not recorded
- Description
- Not recorded
Installation paths
ngrok.exe
C:\*\ngrok.zip
*\ngrok*
Code signing
- signer name
- Ngrok, Inc.
- certificate thumbprint
- 7A54EB0D199484EB8CAEA931C90A744BCF02A7E0
- src file sha256
- c4c1e472823a12e2ee127a64d6ee3de9b31d02bc972baeb8800e6d918dce16a1
- src file path
- downloaded_files/ngrok/c4c1e472823a12e2ee127a64d6ee3de9b31d02bc972baeb8800e6d918dce16a1
FORENSIC EVIDENCE
Network artifacts
- Description
- Known remote domains
- Domains
- connect.ngrok-agent.com
- connect.us.ngrok-agent.com
- connect.eu.ngrok-agent.com
- connect.ap.ngrok-agent.com
- connect.au.ngrok-agent.com
- connect.sa.ngrok-agent.com
- connect.jp.ngrok-agent.com
- connect.in.ngrok-agent.com
- ngrok.com
- *.ngrok-free.app
- *.ngrok.app
- *.ngrok.io
- *.ngrok.dev
- *.ngrok.pro
- *.ngrok.pizza
- Ports
- 443
Detections
- Sigma
- https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/ngrok_network_sigma.yml
- Description
- Detects potential network activity of ngrok RMM tool
- Sigma
- https://github.com/magicsword-io/LOLRMM/blob/main/detections/sigma/ngrok_processes_sigma.yml
- Description
- Detects potential processes activity of ngrok RMM tool