185.156.72[.]80IP address
Reported by 1 independent source · first reported by Elastic Security Labs · last reported
Last reported 15 months ago
What the reports say
2 reports, newest first · the exact sentence from each-
Taking SHELLTER: a commercial evasion framework abused in-the-wild“The C2 for this stealer points to `185.156.72[.]80:15847,` which was [previously identified](hxxps://www.elastic.co/security-labs/a-wretch-client) by our team on June 17th when we discussed this threat in association with the GHOSTPULSE loader.”
-
A Wretch Client: From ClickFix deception to information stealer deployment“| 185.156.72[.]80 | 2025-05-15 | 2025-06-15 |”
Indicators reported together
named in the same reports- 107.189.24[.]67in 1 report
- c865f24e4b9b0855…9a36fbbc2d30in 1 report
- 7d0c9855167e7c19…d25a99b03a10in 1 report
- b3e93bfef1267829…66f122a14dadin 1 report
- da59d67ced88beae…559d00d2c880in 1 report
- 70ec2e65f77a940f…992c1bf974f1in 1 report
- hxxps://www.reddit[.]com/r/PartneredYoutube/comments/1ks2svg/skillshare_sponsorship/in 1 report
- hxxps://github[.]com/elastic/labs-releases/tree/main/tools/shellterin 1 report
- hxxps://github[.]com/elastic/protections-artifacts/blob/ff154ddf0762a4a030c8832eee7753cb19b950ff/behavior/rules/windows/defense_evasion_shellcode_from_unusual_microsoft_signed_module.tomlin 1 report
- hxxps://github[.]com/elastic/protections-artifacts/blob/ff154ddf0762a4a030c8832eee7753cb19b950ff/behavior/rules/windows/defense_evasion_unbacked_shellcode_from_unsigned_module.tomlin 1 report
- hxxps://github[.]com/elastic/protections-artifacts/blob/ff154ddf0762a4a030c8832eee7753cb19b950ff/behavior/rules/windows/defense_evasion_shellcode_execution_from_low_reputation_module.tomlin 1 report
- hxxps://github[.]com/elastic/protections-artifacts/blob/ff154ddf0762a4a030c8832eee7753cb19b950ff/behavior/rules/windows/defense_evasion_potential_evasion_via_invalid_code_signature.tomlin 1 report
- hxxps://github[.]com/elastic/protections-artifacts/blob/ff154ddf0762a4a030c8832eee7753cb19b950ff/behavior/rules/windows/defense_evasion_thread_suspension_from_unbacked_memory.tomlin 1 report
- hxxps://github[.]com/elastic/protections-artifacts/blob/ff154ddf0762a4a030c8832eee7753cb19b950ff/behavior/rules/windows/defense_evasion_suspicious_executable_memory_mapping.tomlin 1 report
- 263ab8c9ec821ae5…fad98d862892in 1 report
- eaglekl[.]digitalin 1 report
- 94.141.12[.]182in 1 report
- plotoraus[.]shopin 1 report
- hxxps://www.shellterproject[.]com/shellter-editions-feature-comparison-table/in 1 report
- www.shellterproject[.]comin 1 report
Copy these 20 indicators · defanged
Thanks — we review every report.