TF-1932556 high

Description

Indicator that identifies a malware distribution server (payload delivery). IOC type: URL that delivers a malware payload. Attributed malware: VShell. Confidence: 95. First seen: 2026-09-25 01:43:12 UTC. Reporter: whack_sh. Tags: exe, Loader, Vshell.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (2)

• Malpedia profile ThreatFox IOCs
• ThreatFox IOC page ThreatFox IOCs

  Indicator that identifies a malware distribution server (payload delivery). IOC type: URL that delivers a malware payload. Attributed malware: VShell. Confidence: 95. First seen: 2026-09-25 01:43:12 UTC. Reporter: whack_sh. Tags: exe, Loader, Vshell.

• PDF Decoding VShell - blog.nviso.eu
  web:blog.nviso.eu

  VShell has evolved into an offensive backdoor, offering modular design, encrypted communications, and cross-platform support, making it a preferred tool for long-term persistence and covert cyber espionage. This report provides defenders with actionable insights to detect and interrupt VShell operations. We share global infrastructure tracking techniques, tools to decrypt VShell communications ...

  2026-09-25 10:03 UTC
• VShell Linux Backdoor - The PolySwarm
  web:blog.polyswarm.io

  VShell is a sophisticated Go-based backdoor targeting Linux systems through a novel infection chain that weaponizes filenames in RAR archives. This malware , linked to Chinese APT groups, exploits common shell scripting practices to execute malicious Bash payloads , delivering a stealthy, memory-resident backdoor capable of remote control, file ...

  2026-09-25 10:03 UTC
• VShell — Malware Profile & Detection | BotEraser
  web:boteraser.com

  The malware uses a modular plugin architecture, allowing it to execute arbitrary commands, upload/download files, capture keystrokes, and enumerate network resources.

  2026-09-25 10:03 UTC
• Vshell: A Chinese-Language Alternative to Cobalt Strike
  web:censys.com

  Vshell is commonly seen within Chinese-speaking offensive-security ecosystems, with users ranging from researchers to red teams as well as threat actors. Release descriptions of Vshell originally called it a RAT (remote access tool), while later versions positioned it as an approachable alternative to commercial adversary-simulation frameworks.

  2026-09-25 10:03 UTC
• VShell Malware: Cross-Platform Remote Access Threat
  web:hunt.io

  VShell is an open-source, cross-platform malware designed to grant attackers remote access to compromised systems. It works on Windows, Linux, and macOS platforms, allowing attackers to execute commands, transfer files, and gather system information.

  2026-09-25 10:03 UTC
• VShell malware — IOCs & CVEs | isMalicious
  web:ismalicious.com

  1,755 indicators of compromise attributed to the VShell malware family — domains, IPs, URLs and file hashes, from abuse.ch feeds.

  2026-09-25 10:03 UTC
• VShell (Malware Family) - malpedia.caad.fkie.fraunhofer.de
  web:malpedia.caad.fkie.fraunhofer.de

  VShell is an OST framework written in Go, enabling availability of implants for multiple platforms (Windows, Linux, macOS).

  2026-09-25 10:03 UTC
• ThreatFox | VShell
  web:threatfox.abuse.ch

  ThreatFox Database Indicators of Compromise (IOCs) on ThreatFox are associated with a certain malware fas. A malware sample can be associated with only one malware family. The page below gives you an overview on indicators of compromise associated with win. vshell . You can also get this data through the ThreatFox API. Database Entry

  2026-09-25 10:03 UTC
• The Silent, Fileless Threat of VShell
  web:trellix-uat.trellix.com

  The payload isn't hidden inside the file content or a macro, it's encoded directly in the filename itself. Through clever use of shell command injection and base64 encoded Bash payloads , the attacker turns a simple file listing operation into an automatic malware execution trigger.

  2026-09-25 10:03 UTC
• The Silent, Fileless Threat of VShell - trellix.com
  web:www.trellix.com

  The Silent, Fileless Threat of VShell By Sagar Bade · August 21, 2025 Introduction Linux environments are often seen as bastions of security, favored by developers, sysadmins, and security professionals for their stability, transparency, and resistance to malware . Compared to Windows, the attack surface is perceived to be smaller, and users typically enjoy a greater degree of control. But ...

  2026-09-25 10:03 UTC

Only Available for Registered Users. Sign in to view.