>samit_hota
Back to IOCs

Indicators of Compromise

5 INDICATORSwin.ghostsocks

GhostSocks — Indicators of Compromise

Samit Hota·
#ioc#ghostsocks

Overview

Indicators of compromise associated with GhostSocks. 5 indicators listed below.

Not exhaustive, and confidence varies. Always corroborate against your own telemetry before taking action.

TypeIndicatorFirst SeenConfidence
ip:port144.31.139.201:30001September 30, 2026100%
ip:port144.31.123.157:30001September 30, 2026100%
ip:port193.23.211.29:30001September 30, 2026100%
ip:port144.31.139.203:30001September 30, 2026100%
ip:port64.188.104.2:30001September 30, 2026100%

Related content

IOCs

404 Keylogger — Indicators of Compromise

IOCs

5.t Downloader — Indicators of Compromise

IOCs

Aberebot — Indicators of Compromise

IOCs

ACR Stealer — Indicators of Compromise

Seeing these indicators in your logs?

Let's figure out how far it's gotten.

Book an advisory call