Ghost RAT

Malware Family

186 indicators of compromise attributed to Ghost RAT across abuse.ch threat intelligence feeds.

Domains

IPs

URLs

Hashes

Download indicators

Indicator lists for this family. Free and anonymous downloads are a 10% sample.

Need continuous updates instead of static lists? The same IOCs ship in the STIX/TAXII threat feed, ready for OpenCTI and MISP.

Botnet C&Cpayload

Indicator	Type
shdufysuf.com	domain
airuhuo.xyz	domain
kele12.vip	domain
severtocs.com	domain
dcleb.com	domain
londonkc.zapto.org	domain
mm.tgoodluck.xyz	domain
23.249.30.24	ip
172.65.185.109	ip
8.219.170.249	ip
8.222.143.232	ip
143.92.56.46	ip
45.205.22.234	ip
47.237.82.83	ip
8.219.160.144	ip
134.122.163.216	ip
192.163.168.47	ip
192.229.117.141	ip
192.238.177.233	ip
129.132.63.206	ip
171.80.9.201	ip
137.220.224.87	ip
152.136.136.244	ip
189.40.200.58	ip
103.124.101.68	ip
98.126.40.18	ip
135.129.122.52	ip
e17f76e0b4c47a5f54ca51b105be0dd29df50c7c	hash
3166ae39b46472d2ee53a880eb8248e0	hash
4f4d405d32d76a170ca2899c70b48ef6ffaaef792e024b6f8aab98d4ae55eae4	hash
93b19bc56952ae1e82f1f41db49f455316736e2b8d161e64b115a150d8dcf204	hash
5f283f5a5eb22bfeb153756a81728bf5d5c6ee71	hash
3a6c44540d1a164f8ec0f8fb3df901f9	hash
6bfcd5ae2d0c24563fe755a56b5c8bb0	hash
6b45cf0473f25fbb8236e6a96d999f088aa78f60	hash
c21c6962c9902ddbf4d08537ea7d96a4	hash
7317d297686d154b4d78217e100df5f57949f05efe095f1a017b5988cddef98b	hash
b2930338fad806be737dd392270160dc	hash
da26a2729ed04d876c8e9c55175ffc2f	hash
3b4bcfe906eeb7207f71a2b3d63e9d192cd223f3	hash
b07741be8853bf69e3da74a3bb66bc3242473ec399ac96e524f971467bea9284	hash
832e5ff3482cd9e4fba4e2fe22799cd8	hash
668dcf124501c1767d4ebc19f29cb44d6474cbff28947d63a695628f467b6345	hash
ca114fe4812a708cd1d36320703beccc6fb927e2	hash
8152d51a72dde734c0e17832263a8884070848a88707731c5e674caae62bcce8	hash
df02d9888c01438bb1a04671ef7de46c6be4a54263af2f3bc0433a5d581d06eb	hash
7cc1bd83d32e117bd0ef78d73647c144	hash

Another file to check? Run a file hash reputation check.