configuration value
Samples sharing one endpoint
4 samples carry this endpoint in their configuration. 1 host was observed serving them. These samples are built to connect to the same endpoint. It may be a redirector or a hijacked host, so a shared endpoint is not evidence of a single operator.
The value
endpoint142.4.58.48:1224
Written into each sample by whoever built it.
The Suricata rules cover the hosts still listed; withdrawn hosts can stay in them for up to five minutes. The YARA rules match the sample hashes. The JSON is this page's data.
1 host
Hosts this archive observed serving these samples; 1 still listed.
4 samples
- 852f7f41ba0ad5a8b8b3fc9f18b299f26987764ad673b036ba143af3955ef4c8 VShell file analysis · last seen 2026-10-06 00:09 · served by 142.4.58.48:1224
- 7b173c58057d91d6b5668c42956bc185afdf9c999bcc7b54ac58fc8452a46615 VShell file analysis · last seen 2026-10-06 00:09 · served by 142.4.58.48:1224
- 83fd0792ed7ff1111870ac10cbe213c1d9449ed523cb62c550ad71f6e9b4e22e VShell file analysis · last seen 2026-10-06 00:09 · served by 142.4.58.48:1224
- ae7d9cb09a0930bb4c86c05acb57110c75d759c75206482c7c880ee58285ca45 VShell sandbox run · last seen 2026-10-06 00:09 · served by 142.4.58.48:1224