Public Mosaic C2 indicators
configuration values

Recurring salt values

45 salt values appear in two or more samples, or on two or more hosts that served them. Each links to its samples, hosts and rule files. Builders reuse default and stock values, so unrelated files can share one. A shared value is not evidence of a single operator.

TLP:CLEAR

A VShell loader’s only configuration is the address and port it calls. The listener key (vkey) and the salt arrive from the listener when the loader connects, so only sandbox runs that reached a live listener show them.

45 values

334 further values each occur in one sample on at most one host, and are on their samples’ pages.

6 values recur across more than three unrelated networks and are not listed here. A shared value is not evidence of a single operator.