Skip to main content

Ghost RAT

Malware Family

216 indicators of compromise attributed to Ghost RAT across abuse.ch threat intelligence feeds.

Domains

10

IPs

85

URLs

0

Hashes

121

Download indicators

Indicator lists for this family. Free and anonymous downloads are a 10% sample.

For continuous updates, the same IOCs ship in the STIX/TAXII threat feed, ready for OpenCTI and MISP.

Threat types

Botnet C&Cpayload

Sample indicators

IndicatorType
shdufysuf.comdomain
airuhuo.xyzdomain
kele12.vipdomain
severtocs.comdomain
dcleb.comdomain
londonkc.zapto.orgdomain
mm.tgoodluck.xyzdomain
idc6.yjzj.orgdomain
hook.ftp21.ccdomain
ssl.ftp21.ccdomain
124.230.195.242ip
172.65.185.109ip
150.158.120.77ip
143.92.61.172ip
8.219.170.249ip
192.252.181.40ip
143.92.56.46ip
108.187.4.245ip
134.122.163.216ip
156.247.40.89ip
192.163.168.47ip
192.229.117.141ip
84.132.18.218ip
108.187.43.3ip
137.220.152.136ip
92.34.34.196ip
8.219.51.115ip
8.210.93.39ip
107.163.56.251ip
156.225.17.60ip
a7632f145e45c8d932f6f1a8ccbbf65e7ae97b0d339c45dfb548e29186db1144hash
99fbd400260206d8480d97d2a1f1b0de9c0bb44bhash
e17f76e0b4c47a5f54ca51b105be0dd29df50c7chash
0e8553970999b60c3a0a2637e0c282ca52b33d3e3ae88c99b6fa426bddc0075dhash
2c707ca426222f790dc10216f9784127b386bf75hash
b2930338fad806be737dd392270160dchash
da26a2729ed04d876c8e9c55175ffc2fhash
c8fe0393370dd2bd98e3bd9c9f24574df794eab70e21c964bb2c2e9b7e460a2dhash
e82aa52c376912a39be0403aceb9281e5d6a39b39bab48af0e43e2cebdd1c6f2hash
98a34bd5670ce59926d308cb1dd7d183fe23bfcf5266df023fca4963374624e9hash
58802bf282ec84421a1a1d64d676cf1c5b189843dc7bb11db3e449ed16d3da30hash
ba2ff4a8b689fab54670cf87b4008528hash
c40eac770e2bc5081175b782c4455d977ccff123571a73c3ab8c8c882db38b85hash
1a6dcfa8d4a429f5511ba3cf83addabdhash
ebda1aecbe1a9cf37f2b0f1cf2adf827e0d0189dhash
8152d51a72dde734c0e17832263a8884070848a88707731c5e674caae62bcce8hash
d72f5c7468f4f8941f46972dcddfca8bae1ed9d1hash
7656ff1c8b9460450225453d8210d394579b0cd02bdad5f1e7be399cc6c06d34hash
ebb16e25f8fbe2d645a05173ecea323fe612c4b2hash
a7e5aee5cc12f8fde0bc93668413722bhash

Another file to check? Run a file hash reputation check.