TF-1932584
high
📛 Threat Title
VShell: URL that delivers a malware payload http://193.160.32.138:8085/?h=193.160.32.138&p=8085&t=ws&a=w32&stage=true
Description
Indicator that identifies a malware distribution server (payload delivery). IOC type: URL that delivers a malware payload. Attributed malware: VShell. Confidence: 95. First seen: 2026-09-25 02:39:09 UTC. Reporter: whack_sh. Tags: exe, Vshell.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
url
http://193.160.32.138:8085/?h=193.160.32.138&p=8085&t=ws&a=w32&stage=true
IOC database
- Type
- url
- Value
http://193.160.32.138:8085/?h=193.160.32.138&p=8085&t=ws&a=w32&stage=true- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- URL that delivers a malware payload attributed to VShell
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (2)
- Malpedia profile ThreatFox IOCs
-
ThreatFox IOC page
ThreatFox IOCs
Indicator that identifies a malware distribution server (payload delivery). IOC type: URL that delivers a malware payload. Attributed malware: VShell. Confidence: 95. First seen: 2026-09-25 02:39:09 UTC. Reporter: whack_sh. Tags: exe, Vshell.
Remediations (10)
-
web:blog.nviso.eu
VShell has evolved into an offensive backdoor, offering modular design, encrypted communications, and cross-platform support, making it a preferred tool for long-term persistence and covert cyber espionage. This report provides defenders with actionable insights to detect and interrupt VShell operations. We share global infrastructure tracking techniques, tools to decrypt VShell communications ...
-
web:boteraser.com
The malware uses a modular plugin architecture, allowing it to execute arbitrary commands, upload/download files, capture keystrokes, and enumerate network resources.
-
web:censys.com
Vshell is commonly seen within Chinese-speaking offensive-security ecosystems, with users ranging from researchers to red teams as well as threat actors. Release descriptions of Vshell originally called it a RAT (remote access tool), while later versions positioned it as an approachable alternative to commercial adversary-simulation frameworks.
-
web:hunt.io
VShell is an open-source, cross-platform malware designed to grant attackers remote access to compromised systems. It works on Windows, Linux, and macOS platforms, allowing attackers to execute commands, transfer files, and gather system information.
-
web:ismalicious.com
1,755 indicators of compromise attributed to the VShell malware family — domains, IPs, URLs and file hashes, from abuse.ch feeds.
-
web:nerds.xyz
Trellix researchers have revealed a new Linux malware that encodes payloads in filenames, silently triggering execution during shell operations to install the VShell backdoor.
-
web:threatfox.abuse.ch
Database Entry Actions Add tag Delete this IOC Report False Positive Export IOC (JSON) Export IOC (CSV)
-
web:threatfox.abuse.ch
Database Entry Actions Add tag Delete this IOC Report False Positive Export IOC (JSON) Export IOC (CSV)
-
web:www.sysdig.com
UNC5174's new campaign Following initial access, a malicious bash script drops two payloads : dnsloger (associated with SNOWLIGHT malware ) and system_worker (associated with Sliver and Cobalt Strike). This step's main focus is establishing persistence by dropping a Sliver implant and an in-memory backdoor ( VShell ) for further exploitation.
-
web:www.trellix.com
The Silent, Fileless Threat of VShell By Sagar Bade · August 21, 2025 Introduction Linux environments are often seen as bastions of security, favored by developers, sysadmins, and security professionals for their stability, transparency, and resistance to malware . Compared to Windows, the attack surface is perceived to be smaller, and users typically enjoy a greater degree of control. But ...
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.