configuration value
Samples sharing one endpoint
4 samples carry this endpoint in their configuration. 1 host was observed serving them. These samples are built to connect to the same endpoint. It may be a redirector or a hijacked host, so a shared endpoint is not evidence of a single operator.
The value
endpoint148.66.17.124:60004
Written into each sample by whoever built it.
The Suricata rules cover the hosts still listed; withdrawn hosts can stay in them for up to five minutes. The YARA rules match the sample hashes. The JSON is this page's data.
1 host
Hosts this archive observed serving these samples; 1 still listed.
4 samples
- eb547da9eea1c3d6ba417236ec039d393bf902722eeeb99661b2aaaa07df4b88 VShell file analysis · last seen 2026-10-04 15:05 · served by 148.66.17.124:60004
- 9d3ec3461c0c2df2c1824ee40d93db84fd99902aa66198d24a978262ab22fca3 VShell file analysis · last seen 2026-10-04 15:05 · served by 148.66.17.124:60004
- c73ec7ed3e1172df8bfe1c94282b3f546ccd19ee9b22cc2173672784ea0ab214 VShell file analysis · last seen 2026-10-04 15:04 · served by 148.66.17.124:60004
- 3b38b1c32ce3ce492a6ee48fe7511a45728a040ae29dcaf222d74516fe4cb0e7 VShell sandbox run · last seen 2026-10-04 15:04 · served by 148.66.17.124:60004