configuration value
Samples sharing one endpoint
4 samples carry this endpoint in their configuration. 1 host was observed serving them. These samples are built to connect to the same endpoint. It may be a redirector or a hijacked host, so a shared endpoint is not evidence of a single operator.
The value
endpoint139.180.213.27:80
Written into each sample by whoever built it.
The Suricata rules cover the hosts still listed; withdrawn hosts can stay in them for up to five minutes. The YARA rules match the sample hashes. The JSON is this page's data.
1 host
Hosts this archive observed serving these samples; 1 still listed.
4 samples
- 2e85a9d9779d702d8d29ca35395ddfd510401b898854a12e4304c6e9584f499f VShell file analysis · last seen 2026-10-05 21:03 · served by 139.180.213.27:80
- 6d05be1aea47e45b7642523c8a1b88e78d12f7322597b8da619ed92a4c1fbfdd VShell file analysis · last seen 2026-10-05 21:03 · served by 139.180.213.27:80
- 985f138372436a08a597839f4e778b2880df162c17ee373d8d1131e0bdeb061c VShell file analysis · last seen 2026-10-05 21:03 · served by 139.180.213.27:80
- dd8a57a95a034be9779580b72c5c9b9d9245bc7b157268e796ebdad87d113aa0 VShell sandbox run · last seen 2026-10-05 21:03 · served by 139.180.213.27:80