Public Mosaic C2 indicators
sample

aae234c674f66a207d3dcd39b11045bda56dae92bf1f8aef6ee57be3faeb079a

A VShell sample, identified by running it in a sandbox and extracting its configuration.

aae234c674f66a207d3dcd39b11045bda56dae92bf1f8aef6ee57be3faeb079a

TLP:CLEAR

Sample

sha-256aae234c674f66a207d3dcd39b11045bda56dae92bf1f8aef6ee57be3faeb079a
familyVShell
identified bysandbox run
first seen2026-09-08 17:50 UTC
last seen2026-09-23 18:14 UTC
VirusTotal →

VShell configuration

Extracted by running this sample in a sandbox. Endpoints are where the sample is configured to connect. An endpoint is listed on this site only if the scanner confirmed it separately. The other values are settings written into the sample.

endpoint · tcp149.104.28.204:61372
beacon typews

These values can match this sample to others built the same way.

vkey21ji3j12i3asdsa
saltahsidiasjdias

Pivots: other samples whose configuration carries the same value. A shared value is not evidence of a single operator.

same endpoint → 3 other samples same beacon type → 352 other samples

Browse recurring values: vkey · salt

Every sample’s configuration, as signed-in downloads (free account): JSON · STIX · CSV.

Served by 1 address

A widely distributed file can reach unrelated hosts.