TF-1932557
high
📛 Threat Title
VShell: URL that delivers a malware payload http://v.teruishuo.net:8443/?h=v.teruishuo.net&p=8443&t=tcp&a=w32&stage=true
Description
Indicator that identifies a malware distribution server (payload delivery). IOC type: URL that delivers a malware payload. Attributed malware: VShell. Confidence: 95. First seen: 2026-09-25 01:44:14 UTC. Reporter: whack_sh. Tags: exe, Vshell.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
url
http://v.teruishuo.net:8443/?h=v.teruishuo.net&p=8443&t=tcp&a=w32&stage=true
IOC database
- Type
- url
- Value
http://v.teruishuo.net:8443/?h=v.teruishuo.net&p=8443&t=tcp&a=w32&stage=true- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- URL that delivers a malware payload attributed to VShell
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (2)
- Malpedia profile ThreatFox IOCs
-
ThreatFox IOC page
ThreatFox IOCs
Indicator that identifies a malware distribution server (payload delivery). IOC type: URL that delivers a malware payload. Attributed malware: VShell. Confidence: 95. First seen: 2026-09-25 01:44:14 UTC. Reporter: whack_sh. Tags: exe, Vshell.
Remediations (10)
-
web:blog.nviso.eu
VShell has evolved into an offensive backdoor, offering modular design, encrypted communications, and cross-platform support, making it a preferred tool for long-term persistence and covert cyber espionage. This report provides defenders with actionable insights to detect and interrupt VShell operations. We share global infrastructure tracking techniques, tools to decrypt VShell communications ...
-
web:boteraser.com
A 2021 report by Mandiant tied VShell to the compromise of several U.S. defense contractors and European software firms, exploiting CVEs such as CVE-2019-19781 (Citrix ADC) and CVE-2020-5902 (F5 BIG-IP) for initial access.
-
web:hunt.io
VShell is an open-source, cross-platform malware designed to grant attackers remote access to compromised systems. It works on Windows, Linux, and macOS platforms, allowing attackers to execute commands, transfer files, and gather system information.
-
web:ismalicious.com
1,755 indicators of compromise attributed to the VShell malware family — domains, IPs, URLs and file hashes, from abuse.ch feeds.
-
web:threatfox.abuse.ch
ThreatFox Database Indicators of Compromise (IOCs) on ThreatFox are associated with a certain malware fas. A malware sample can be associated with only one malware family. The page below gives you an overview on indicators of compromise associated with win. vshell . You can also get this data through the ThreatFox API. Database Entry
-
web:threatfox.abuse.ch
VShell IOC: http ://v.teruishuo.net:8443/?h=v.teruishuo.net&p=8443&t=tcp&a=w64&stage=true ( url )
-
web:undercodetesting.com
A large-scale cyber espionage campaign leveraging the VShell backdoor has compromised over 1,500 servers worldwide, targeting government, healthcare, military, and research organizations for long-term infiltration. This open-source, cross-platform remote access trojan (RAT) provides attackers with stealthy, persistent control, making it a tool of choice for sophisticated threat actors ...
-
web:www.nviso.eu
NVISO has actively tracked VShell for months, a Chinese-language intrusion tool used in espionage campaigns. NVISO has actively tracked VShell for months, a Chinese-language intrusion tool used in espionage campaigns. We share global infrastructure tracking techniques, tools to decrypt VShell communications, and insights into attacker behaviors.
-
web:www.thousandguards.com
The discovery of a novel Linux malware delivery chain marks one of the most inventive and dangerous evolutions in recent years. Security researchers revealed that the VShell backdoor—an open-source remote access trojan (RAT) already linked to Chinese state-sponsored groups—is now being spread through malicious filenames hidden inside RAR archive attachments. Unlike typical malware , which ...
-
web:www.trellix.com
The Silent, Fileless Threat of VShell By Sagar Bade · August 21, 2025 Introduction Linux environments are often seen as bastions of security, favored by developers, sysadmins, and security professionals for their stability, transparency, and resistance to malware . Compared to Windows, the attack surface is perceived to be smaller, and users typically enjoy a greater degree of control. But ...
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.