Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
10 IOCs
Malicious Crypto Shell Packages Target RubyGems
Threat Actors
Malware Families
Excerpt
Malicious Crypto Shell Packages Target RubyGems | OpenSourceMalware BLOG Malicious Crypto Shell Packages Target RubyGems A threat actor calling themselves "Ghost Dev" published 42 malicious typo squat packages to the RubyGems registry targeting crypto and web3 packages By c0a15726-c5b1-4b0d-85e6-fe15553df9e2 · 2026-10-05T10:59:28.013Z The OpenSourceMalware automatic detection engine has identified 40+ malicious packages that use typosquatting, brandjacking, and…
Read the original report →Diamond Model
Adversary(1)
Infrastructure(4)
Capability(2)
Victim
Indicators of Compromise
Open the mindmap →10 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| SHA256 | b857fdf59db6948ea01643d935742904e9275572e63cd23331a9405483c6379c | Medium | Score 53/100 | First seen |
| SHA256 | 57a56ab47fa7f33147d4924b07e77d773515b4a06ca9ac090874209a9950f30b | Medium | Score 53/100 | First seen |
| IP | 45.138.12.177 | High | Score 58/100 | First seen |
| URL | http://45.138.12.177:8080/wi/grab | High | Score 58/100 | First seen |
| SHA256 | 075b6ac656aa414e2d21b9d1bc8b0fd030902202222e9d06a326fd80d7827ae6 | Medium | Score 53/100 | First seen |
| SHA256 | 33276fedf0632be39b4e8a646c520bfa081bb7e67dce52042da46bbbda16d440 | Medium | Score 53/100 | First seen |
| URL | http://45.138.12.177:8080/w | High | Score 58/100 | First seen |
| URL | http://45.138.12.177:8092/wgkit.tar.gz | High | Score 58/100 | First seen |
| SHA256 | 387a778a6376b6c060516ce5c1191a61e075acfe3fb073e6e5cd78eeb96a95b3 | Medium | Score 53/100 | First seen |
| SHA256 | 549d35217f1e884634993ba6f13dd8e82091dd9f995a9ed0cb575958e63f073d | Medium | Score 53/100 | First seen |
IOC Relationship Graph
Building graph…