ScanMalware.com
Known malicious kitcriticalother

GhostFrame ESXi post-exploitation framework: operator panel

family: ghostframe-esxi-c2-panel-2026-11
Short link:scanmalware.com/h/365

Operator panel of GhostFrame, a post-exploitation framework for VMware ESXi hosts that has been seen in intrusions which later ended in Settra ransomware. An attacker who already holds root on an ESXi host runs a small ELF stager on it (vmhostd-core), optionally made persistent as a VIB package, and then works from this web console: listing virtual machines, switching their power, taking and deleting snapshots, opening their consoles over VNC, harvesting Windows credentials from virtual-machine memory and disk images with the open-source VMkatz, capturing logins to the ESXi management interface, and opening a SOCKS5 proxy into the network. The console is a single-page web application on port 8080 that asks for an API token. This hunt matches the console by its page code, so renamed builds are still found, and tracks its title, icon, code files and known panel addresses.

Anchors

Hunting ruleGhostFrame_ESXi_C2_Panel
SMQL queryrun
(title:"GhostFrame" AND NOT title:"Sandbox") OR favicon_hash:87052478 OR favicon_hash:-687228996 OR js_sha256:f262af98139c0b54602dc3b42ee5261fb6e5f03bef20041a9c75cb384068da0a OR js_sha256:52ea6a25f1e504cf6d30e094c18520f5bf6b461ac9ec4b45154846a6110bbe15 OR ip:45.158.196.81 OR ip:45.158.196.141 OR ip:162.33.178.5 OR ip:45.61.136.104 OR ip:193.149.176.16 OR ip:104.156.225.154 OR ip:45.158.196.143 OR ip:64.52.80.59 OR ip:64.190.113.132 OR ip:140.82.29.164

Provenance

Added: 2026-11-11 20:30
Panels answering on port 8080 in November 2026: 45[.]158[.]196[.]81, 45[.]158[.]196[.]141, 162[.]33[.]178[.]5, 45[.]61[.]136[.]104, 193[.]149[.]176[.]16 and 104[.]156[.]225[.]154. Further panel addresses reported publicly for the same framework: 45[.]158[.]196[.]143, 64[.]52[.]80[.]59, 64[.]190[.]113[.]132 and 140[.]82[.]29[.]164. Two builds of the console are in use; the newer one adds agent groups and an offline-agent list. Server addresses are rented and get reassigned, so a later scan of one of these addresses is a lead, not proof; the page-code match is the reliable signal. The ESXi implant itself (SHA-256 a05eae6d07b82e2e5451a72266f21fbaf76486ef4920a820988de93e15353a10) calls back to its server on several ports at once (53, 2222, 3389, 4444, 8443, 9443). A page titled 'GhostFrame // Secure Sandbox' is an unrelated browser tab-cloaking tool and is excluded.
References:

Sightings (12)Atom feed

HostScanScriptMatchScanned
45.158.196.81:80803b355fed…http://45.158.196.81:8080/assets/index-E7C15i1x.jsrule2026-11-11 20:17
45.158.196.813b355fed…—query2026-11-11 20:17
104.156.225.154:8080643ebef6…http://104.156.225.154:8080/assets/index-E7C15i1x.jsrule2026-11-11 20:17
104.156.225.154643ebef6…—query2026-11-11 20:17
193.149.176.16:8080e74a8bcf…http://193.149.176.16:8080/assets/index-19w95Ckt.jsrule2026-11-11 20:17
193.149.176.16e74a8bcf…—query2026-11-11 20:17
45.158.196.141:808017236729…http://45.158.196.141:8080/assets/index-E7C15i1x.jsrule2026-11-11 20:17
45.158.196.14117236729…—query2026-11-11 20:17
45.61.136.104:8080477d39ee…http://45.61.136.104:8080/assets/index-E7C15i1x.jsrule2026-11-11 20:17
45.61.136.104477d39ee…—query2026-11-11 20:17
162.33.178.5:8080aedaf846…http://162.33.178.5:8080/assets/index-E7C15i1x.jsrule2026-11-11 20:17
162.33.178.5aedaf846…—query2026-11-11 20:17