Public Mosaic C2 indicators
sample

26cd6ab210fa3151b9ab56bdaa8a510ca26796c55a0a968962f2f25cb4c42cc4

A VShell sample, identified by running it in a sandbox and extracting its configuration.

26cd6ab210fa3151b9ab56bdaa8a510ca26796c55a0a968962f2f25cb4c42cc4

TLP:CLEAR

Sample

sha-25626cd6ab210fa3151b9ab56bdaa8a510ca26796c55a0a968962f2f25cb4c42cc4
familyVShell
identified bysandbox run
first seen2026-09-08 04:45 UTC
last seen2026-10-06 00:05 UTC
VirusTotal →

VShell configuration

Extracted by running this sample in a sandbox. Endpoints are where the sample is configured to connect. An endpoint is listed on this site only if the scanner confirmed it separately. The other values are settings written into the sample.

endpoint · tcp102.129.165.177:63525
beacon typetcp

These values can match this sample to others built the same way.

vkeya2123cD
saltAxxSDCcFASD

Pivots: other samples whose configuration carries the same value. A shared value is not evidence of a single operator.

same endpoint → 3 other samples same beacon type → 920 other samples

Browse recurring values: vkey · salt

Every sample’s configuration, as signed-in downloads (free account): JSON · STIX · CSV.

Served by 1 address

A widely distributed file can reach unrelated hosts.