configuration value
Samples sharing one endpoint
4 samples carry this endpoint in their configuration. 1 host was observed serving them. These samples are built to connect to the same endpoint. It may be a redirector or a hijacked host, so a shared endpoint is not evidence of a single operator.
The value
endpoint148.66.17.125:60004
Written into each sample by whoever built it.
The Suricata rules cover the hosts still listed; withdrawn hosts can stay in them for up to five minutes. The YARA rules match the sample hashes. The JSON is this page's data.
1 host
Hosts this archive observed serving these samples; 1 still listed.
4 samples
- c696953c34075a66b093d75d3cd531a7faa394ea273c8cfe323fc05966123b4b VShell file analysis · last seen 2026-10-04 15:03 · served by 148.66.17.125:60004
- ac63fdbd0b407b4e2c9b5c30da1f998795f4b472c1a2845d56a4da6f8b1a170a VShell file analysis · last seen 2026-10-04 15:03 · served by 148.66.17.125:60004
- 30c11e3652b5d6f3bd7a471dff5c5e71ca726bd1aa719ee902d52c53269b768a VShell file analysis · last seen 2026-10-04 15:03 · served by 148.66.17.125:60004
- 6001369bf6c9dfd815e40f2a62ba7c5b4f523a125c3c442147034ec8250c1bda VShell sandbox run · last seen 2026-10-04 15:03 · served by 148.66.17.125:60004