TF-MAL-ps1.thundershell

Description

ThreatFox malware family `ps1.thundershell`. Printable name: ThunderShell.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (1)

• ThreatFox: IOCs for this family ThreatFox Malwares

• Ransomware Group Targets IT Workers with SharpRhino RAT Malware
  web:advisory.eventussecurity.com

  Researchers have identified a new malware variant linked to the ThunderShell malware family . Dubbed SharpRhino, this Remote Access Trojan (RAT) represents an evolution in the tactics of the ransomware group Hunters International.

  2026-05-22 05:31 UTC
• MalwareBazaar | ThunderShell
  web:bazaar.abuse.ch

  A malware sample can be associated with only one malware family . The page below gives you an overview on malware samples that MalwareBazaar has identified as ThunderShell .

  2026-05-22 05:31 UTC
• Threat Coverage: How FortiEDR protects against WorkersDevBackdoor ...
  web:community.fortinet.com

  FortiEDR Threat Hunting queries for detecting ThunderShell behaviors, MITRE ATT&CK mappings for ThunderShell capabilities and the recent campaigns and IOCs from recent campaigns are included in this article to support proactive threat hunting activities.

  2026-05-22 05:31 UTC
• Thunderstruck! Malicious ads for RVTools lead to ThunderShell payload
  web:fieldeffect.com

  Conclusion Malvertising remains a persistent and evolving threat, with cybercriminals continuing to exploit sponsored ads to deliver malicious payloads like ThunderShell . For example, in September 2023, Field Effect observed IcedID malware being promoted via sponsored Google ads for Webex's popular virtual meeting software.

  2026-05-22 05:31 UTC
• ThunderShell (Malware Family)
  web:malpedia.caad.fkie.fraunhofer.de

  Details for the ThunderShell malware family including references, samples and yara signatures.

  2026-05-22 05:31 UTC
• FBI and CISA Warn of BlackSuit Ransomware That Demands Up to $500 Million
  web:thehackernews.com

  A case example is Hunters International, which has been observed using a new C#-based malware called SharpRhino as an initial infection vector and a remote access trojan (RAT). A variant of the ThunderShell malware family , it's delivered through a typosquatting domain impersonating the popular network administration tool Angry IP Scanner.

  2026-05-22 05:31 UTC
• Technical Approaches to Uncovering and Remediating Malicious ... - CISA
  web:www.cisa.gov

  It highlights technical approaches to uncovering malicious activity and includes mitigation steps according to best practices. The purpose of this report is to enhance incident response among partners and network administrators along with serving as a playbook for incident investigation.

  2026-05-22 05:31 UTC
• Why SharpRhino Malware is Leaving Victims Thunderstruck
  web:www.infosecurity-magazine.com

  SharpRhino is a recent addition to the malware arsenal of the cyberthreat group Hunters International that was first identified in August 2024. This sophisticated malware leverages the open-source project ThunderShell , a powerful remote access tool that has been repurposed for malicious intent.

  2026-05-22 05:31 UTC
• Quorum webinar on ThunderShell malware - LinkedIn
  web:www.linkedin.com

  During a recent #ransomware incident investigated by the Quorum Cyber #ThreatIntelligence team, a malware variant linked to the # ThunderShell # malware family was identified. Want to know more ...

  2026-05-22 05:31 UTC
• New Hunters International RAT identified by Quorum Cyber
  web:www.quorumcyber.com

  During a recent ransomware incident investigated by the Quorum Cyber Incident Response team, a malware variant linked to the ThunderShell malware family was identified. The team's analysts have attributed the malware , named SharpRhino, to Hunters International, a prominent threat actor group believed to be affiliated with Russia.

  2026-05-22 05:31 UTC

Only Available for Registered Users. Sign in to view.