configuration value
Samples sharing one endpoint
4 samples carry this endpoint in their configuration. 1 host was observed serving them. These samples are built to connect to the same endpoint. It may be a redirector or a hijacked host, so a shared endpoint is not evidence of a single operator.
The value
endpoint148.66.17.122:60003
Written into each sample by whoever built it.
The Suricata rules cover the hosts still listed; withdrawn hosts can stay in them for up to five minutes. The YARA rules match the sample hashes. The JSON is this page's data.
1 host
Hosts this archive observed serving these samples; 1 still listed.
4 samples
- 0d57dcf6992d2205409d04d4fdb98b59f4324cf9a7f420a556fd49f845214a89 VShell file analysis · last seen 2026-10-02 09:15 · served by 148.66.17.122:60003
- b9da7bc35b4428fa86fde9ad283aaeb7c3646bf9d6e9ea86c242739757bd490a VShell file analysis · last seen 2026-10-02 09:15 · served by 148.66.17.122:60003
- d23adf99ba8cb35a7426827877a6c96b3ef0efc5aa90370276e9a8d74cf3595d VShell file analysis · last seen 2026-10-02 09:14 · served by 148.66.17.122:60003
- 9534c0c79d130ff0e3f74189e557ad0521996b9610b20ebc67f51a839b783bbf VShell sandbox run · last seen 2026-10-02 09:14 · served by 148.66.17.122:60003