Public Mosaic C2 indicators
sample

eb4f13d7317a47a531e63ed20c393d3aae9ac43daa7882c84da80dc76fbb5548

A VShell sample, identified from its own bytes without running it (an embedded configuration).

eb4f13d7317a47a531e63ed20c393d3aae9ac43daa7882c84da80dc76fbb5548

TLP:CLEAR

Sample

sha-256eb4f13d7317a47a531e63ed20c393d3aae9ac43daa7882c84da80dc76fbb5548
familyVShell
identified byfile analysis
first seen2026-09-04 21:27 UTC
last seen2026-10-06 00:09 UTC
VirusTotal →

VShell configuration

Read from the file without running it. Endpoints are where the sample is configured to connect. An endpoint is listed on this site only if the scanner confirmed it separately. A VShell loader’s only configuration is the address and port it calls. The listener key (vkey) and the salt arrive from the listener when the loader connects, so only sandbox runs that reached a live listener show them.

endpoint · tcp106.13.74.88:8084

Pivots: other samples whose configuration carries the same value. A shared value is not evidence of a single operator.

same endpoint → 2 other samples

Every sample’s configuration, as signed-in downloads (free account): JSON · STIX · CSV.

Served by 1 address

A widely distributed file can reach unrelated hosts.