Indicators

AS205759

GHOSTYNETWORKS / Ghosty Networks LLC

64.89.160.0/24

Primary US range

46.151.182.0/24

Netherlands range

43.228.157.0/24

Pakistan range

64.89.160.0/23

AS205759 aggregate range

46.151.182.230

Malicious activity

64.89.161.138

Malicious domain host

64.89.161.43

Malicious domain host

83.142.209.40

Malicious domain host

64.89.160.132

Threat intelligence

43.228.157.121

Port 9050 activity — also ClickFix C2

83.142.209.64

Spam-sending IP

46.151.182.60

Phishing domain host

ghostynetworks.com

Primary domain

download-windows.org

Malicious download domain

autocad.download-windows.org

Malicious subdomain

1984.fefetrans.ro

Malicious activity

tradeslivania.online

Hosted on AS205759

kms-kinesis.com

Hosted on AS205759

app.tradesilvaniia.com

Hosted on AS205759

c5d712f82d5d37bb284acd4468ab3533

MD5 — primary Cring.exe

f7d270ca0f2b4d21830787431f881cd004b2eb102cc3048c6b4d69cb775511c8

SHA-256 — primary Cring.exe

3426e8dcb104d9b01874498fb44c6e460228a9a0

SHA-1 — primary Cring.exe

ac58a214ce7deb3a578c10b97f93d9c3

MD5 — additional sample

5AC0D8C3E2C8854B2E7348202CBCF9ED

MD5 — Ghost ransomware

F5920FDE2B0F9FF3689B8FCF44885BA2

MD5 — Ghost ransomware

17CEE87AE2D648BE25DB4A9691837DCA

MD5 — Ghost ransomware

E61D8EFC326AC9E3FCC455C6D2257D56

MD5 — Ghost ransomware

60E407C01626EF316591CD8F8300113DB8F6508E302D06CF19A0D7CA8451EC96

SHA-256 — Ghost ransomware

Cring.exe

Primary ransomware payload

Ghost.exe

Variant

Locker.exe

Variant

ElysiumO.exe

Variant

Crypt3r

Internal name

[email protected]

Ghost actors

[email protected]

Ghost actors

[email protected]

Ghost actors

[email protected]

Ghost actors

[email protected]

Ghost actors

[email protected]

Ghost actors

[email protected]

Ghost actors

CVE-2018-13379

Fortinet FortiOS — HIGH

CVE-2010-2861

Adobe ColdFusion

CVE-2009-3960

Adobe ColdFusion

CVE-2021-34473

Microsoft Exchange — HIGH

CVE-2021-34523

Microsoft Exchange — HIGH

CVE-2021-31207

Microsoft Exchange — HIGH

CVE-2026-26980

Ghost CMS 3.24.0–6.19.0 — CVSS 9.4 CRITICAL

43.228.157.121

Port 9050 / C2 infrastructure

144.31.236.66

Rotating C2 domains resolve here

restrictes.com

C2 domain, wave 1

com-apps.cc

C2 domain, wave 1

clo4shara.xyz

C2 domain, initial wave

jalwat.com

C2 domain

web-telegram.ug

C2 domain

/11z77u3.php

C2 path

cloud-verification.com

Fake Cloudflare challenge page

link.storjshare.io

DLL download host

taketwolabs.com/wp-content/

DLL download path

UtilifySetup.exe

Electron stealer/RAT — zero VT detections at first sighting

update.zip

Dropper payload

mickeymousegamesdealer.alexavegas.icu

C2

productionsamplesoftheyear.cgdirector.icu

C2

advancedaisolutionsforeveryone.a1si.icu

C2

a3ufz.xsjdsb.icu/wp-json/prometheus-plus/certs-at-home/downloads

C2 path — Prometheus lure

OYSTERSHUCK

Decoder — amplifier.js

OYSTERFRESH

Initial dropper — certificate.js

OYSTERBLUES

Encrypted payload — Oyster.js

amplifier.js

OYSTERSHUCK filename

certificate.js

OYSTERFRESH

Oyster.js

OYSTERBLUES

EdgeSystemConfig.dll

CSBEACON

EdgeTaskMachine.js

Component

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\Blue'Oyster'

OYSTER registry key

MicrosoftEdgeUpdate

Run key

WindowsEdgeStartup

Run key

MicrosoftEdgeUpdateTaskMachine

Scheduled task

51.89.204.28:4444

Hardcoded C2 in MedusaHVNC variant