configuration value
Samples sharing one endpoint
4 samples carry this endpoint in their configuration. 1 host was observed serving them. These samples are built to connect to the same endpoint. It may be a redirector or a hijacked host, so a shared endpoint is not evidence of a single operator.
The value
endpoint148.66.17.126:60002
Written into each sample by whoever built it.
The Suricata rules cover the hosts still listed; withdrawn hosts can stay in them for up to five minutes. The YARA rules match the sample hashes. The JSON is this page's data.
1 host
Hosts this archive observed serving these samples; 1 still listed.
4 samples
- aa64a05f862916378d45fcbbd7509e5ed7a2007fafb79a56428b2e1245869b89 VShell file analysis · last seen 2026-10-02 09:15 · served by 148.66.17.126:60002
- 9f1fe2938db17794123d344eb6743e6d0ec03428bf626cbe26d15daa99eebd5c VShell file analysis · last seen 2026-10-02 09:15 · served by 148.66.17.126:60002
- f099e3f576e5bcdfdcf372f1022fc30476d9c513b53db0ca0156106e3f8f4c50 VShell file analysis · last seen 2026-10-02 09:15 · served by 148.66.17.126:60002
- ea48ebbeaa8d8c2d410d740bd2825d9380c055458b739e696a2b14714e9fda3d VShell sandbox run · last seen 2026-10-02 09:15 · served by 148.66.17.126:60002