45.13.135.103
45.13.135.103 is an IP address
that 4 published sources report
in connection with Kimsuky activity, which public reporting
attributes to North Korea (DPRK).
It is cited here from ESTsecurity ALYac, Malwarebytes, PWC and swanleesec.
The earliest of those reports is dated 2020-09-04 and the most recent 2026-10-18.
ip address Kimsuky MATCHED IN SOURCE
Network
| Kind | data centre |
|---|---|
| Network | Hostinger International Limited |
| Announced by | AS47583 Hostinger International Limited |
| Country | United States |
| Flags | hosting range |
Sources
-
…C2 주소는 'eastsea.or.kr (45.13.135.103)' 입니다.…
北 연계 탈륨조직, '블루 에스티메이트(Blue Estimate)' APT 캠페인 지속 — ESTsecurity ALYac -
…Here are some of IPs and domains used by the actor for C2 communications: 210.16.120.34 216.189.157.89 45.58.55.73 45.13.135.103 27.102.114.89 210.16.121.137 58.229.208.146 27.102.107.63 download.riseknite.life onedrive-upload.ikpoo.cf alps.travelmountain.ml…
Kimsuky APT continues to target South Korean government using AppleSeed backdoor — Malwarebytes -
…2020 16 To catch a Banshee: One pivot to find them Black Banshee C2 infrastructure tends to have many overlaps Let’s take a single IP: 45.13.135.103 ● Different domains over months ● Goldmine of email phishing (Gmail, Naver, Daum…) ● Crossover with AppleSeed C2s ● MIND THE HYPHEN More…
To catch a Banshee: How Kimsuky’s tradecraft betrays its complementary campaigns and mission — PWC -
…— 실제로는 exe 실행 파일이며 C&C 서버에 연결, 레지스트리 변조, explorer.exe에 인젝션과 같은 실제 악성행위를 수행합니다. 네트워크 연결 http://suzuki.datastore.pe.hu (45.13.135.103:80) C&C 서버로 접속을 시도합니다. http://suzuki.datastore.pe.hu//?m=a&p1=5254004a04af&p2=win_6.1.7601-x32_DROPPER 을 통해 추가적으로 악성파일을 다운로드 합니다. p1 에는…
Kimsuky group's resume impersonation malware — swanleesec
Find this indicator in the index, or see every IP address this site holds under IP addresses in the browse listing.