45.138.12[.]177IP address
Reported by 1 independent source · first reported by The Hacker News · last reported
Last reported 16 days ago
What the reports say
1 report, newest first · the exact sentence from each-
ThreatsDay: Ransomware Affiliate Betrayal, WhatsApp RAT, Exposed Hacker Tools and 12 More Stories“…eveloper’s machine, they wait 20 to 40 minutes in the background, then do one of two things: (1) Eleven gems open a reverse shell to 45.138.12[.]177 on port 8089 or 8090, and (2) Thirty-one gems download wgkit.tar.gz from 45.138.12.177:8092 and run wg_install.sh from it." Also dete…”
Indicators reported together
named in the same reports- hunt[.]ioin 1 report
- c2.installscenter[.]comin 1 report
- painel.installscenter[.]comin 1 report
- 80.78.27[.]252in 1 report
- 151.243.232[.]123in 1 report
Copy these 5 indicators · defanged
Thanks — we review every report.