TF-1932588
high
📛 Threat Title
VShell: SHA256 hash of a malware sample (payload) 610d3e3bfef18e116a7de3aae9d8d7a941cb5664a0af78304d6fbaef62a2dc03
Description
Indicator that identifies a malware sample (payload). IOC type: SHA256 hash of a malware sample (payload). Attributed malware: VShell. Confidence: 95. First seen: 2026-09-25 02:44:38 UTC. Reporter: whack_sh. Tags: exe, Vshell.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
hash_sha256
610d3e3bfef18e116a7de3aae9d8d7a941cb5664a0af78304d6fbaef62a2dc03
IOC database
- Type
- hash_sha256
- Value
610d3e3bfef18e116a7de3aae9d8d7a941cb5664a0af78304d6fbaef62a2dc03- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- SHA256 hash of a malware sample (payload) attributed to VShell
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (2)
- Malpedia profile ThreatFox IOCs
-
ThreatFox IOC page
ThreatFox IOCs
Indicator that identifies a malware sample (payload). IOC type: SHA256 hash of a malware sample (payload). Attributed malware: VShell. Confidence: 95. First seen: 2026-09-25 02:44:38 UTC. Reporter: whack_sh. Tags: exe, Vshell.
Remediations (10)
-
web:bazaar.abuse.ch
Information on VShell malware sample ( SHA256 8d06ef4fd7819b75943dec120fbd50c1fd0820c760734fa13f7ffa6fac85d1d9) You are currently viewing the MalwareBazaar entry for ...
-
web:bazaar.abuse.ch
You are currently viewing the MalwareBazaar entry for SHA256 f813d309920d6109c1bfe88f1020d44814123e884a6a9fdb9bccb8a406c799cc. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
-
web:blog.nviso.eu
VShell has evolved into an offensive backdoor, offering modular design, encrypted communications, and cross-platform support, making it a preferred tool for long-term persistence and covert cyber espionage. This report provides defenders with actionable insights to detect and interrupt VShell operations. We share global infrastructure tracking techniques, tools to decrypt VShell communications ...
-
web:boteraser.com
The malware uses a modular plugin architecture, allowing it to execute arbitrary commands, upload/download files, capture keystrokes, and enumerate network resources.
-
web:github.com
Malware - Hash -Database aims to provide a centralized collection of malware hashes for use in cybersecurity research, threat intelligence, and digital forensics. By maintaining a diverse set of hash types and regularly updating the repository, we aim to support professionals in identifying and analyzing malware threats effectively.
-
web:ismalicious.com
Database of known malware file hashes. MD5, SHA1, and SHA256 hashes with malware family classification. Updated daily from sandbox analysis and vendor feeds.
-
web:ismalicious.com
1,755 indicators of compromise attributed to the VShell malware family — domains, IPs, URLs and file hashes, from abuse.ch feeds.
-
web:threatfox.abuse.ch
VShell IOC: 953a438fd6034f420b2ac591a4871b4e386aa907e2ed9ca9116aa1c37b17f513 ( sha256_hash ) You are viewing the ThreatFox database entry for sha256_hash ...
-
web:www.sysdig.com
The SNOWLIGHT malware acts as a dropper for a fileless payload that resides solely in memory, called VShell . VShell is a Remote Access Trojan (RAT) popular among Chinese-speaking cybercriminals in several forums, and its main developer is also a Chinese speaker.
-
web:www.trellix.com
Final payload : VShell malware VShell malware is a Go-based backdoor used primarily by Chinese APT groups for remote access, file operations, and post-exploitation control on infected systems especially Linux servers.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.