configuration value
Samples sharing one endpoint
4 samples carry this endpoint in their configuration. 1 host was observed serving them. These samples are built to connect to the same endpoint. It may be a redirector or a hijacked host, so a shared endpoint is not evidence of a single operator.
The value
endpoint148.66.17.122:443
Written into each sample by whoever built it.
The Suricata rules cover the hosts still listed; withdrawn hosts can stay in them for up to five minutes. The YARA rules match the sample hashes. The JSON is this page's data.
1 host
Hosts this archive observed serving these samples; 1 still listed.
4 samples
- 6cb21d7da52a8d0b50ea489e5123de0c35c4888716e72b1b5bbb0f361b79e49a VShell file analysis · last seen 2026-09-23 03:02 · served by 148.66.17.122:443
- ca005423a98cfc57a7df77d94a0d6ae396a859aae79c2bf151f18c8eb964c483 VShell file analysis · last seen 2026-09-23 03:02 · served by 148.66.17.122:443
- 34db44e7d02ffd81a06254cabf3e61199cde7ed34c9e31b16bde1d8dbc7bdcb3 VShell file analysis · last seen 2026-09-23 03:02 · served by 148.66.17.122:443
- ae469ebffa97b09aec32c60f4c01e90af9a1d67a051d504b5d1f5375af47efeb VShell sandbox run · last seen 2026-09-23 03:01 · served by 148.66.17.122:443