s2
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

TF-1932583 high

📛 Threat Title

VShell: URL that delivers a malware payload http://123.254.106.168/?h=123.254.106.168&p=80&t=tcp&a=w64&stage=true

Category: VShell Published: Source updated: First seen: Last updated: Source: ThreatFox IOCs

Description

Indicator that identifies a malware distribution server (payload delivery). IOC type: URL that delivers a malware payload. Attributed malware: VShell. Confidence: 95. First seen: 2026-09-25 02:39:07 UTC. Reporter: whack_sh. Tags: exe, Vshell.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

url http://123.254.106.168/?h=123.254.106.168&p=80&t=tcp&a=w64&stage=true

IOC database

Type
url
Value
http://123.254.106.168/?h=123.254.106.168&p=80&t=tcp&a=w64&stage=true
First seen
Last seen
Attached to this threat
Appears in
1 threat
Description
URL that delivers a malware payload attributed to VShell

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Details From VirusTotal

No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.

References (2)

  • Malpedia profile ThreatFox IOCs
  • ThreatFox IOC page ThreatFox IOCs

    Indicator that identifies a malware distribution server (payload delivery). IOC type: URL that delivers a malware payload. Attributed malware: VShell. Confidence: 95. First seen: 2026-09-25 02:39:07 UTC. Reporter: whack_sh. Tags: exe, Vshell.

Remediations (10)

  • PDF Decoding VShell - blog.nviso.eu
    web:blog.nviso.eu

    VShell has evolved into an offensive backdoor, offering modular design, encrypted communications, and cross-platform support, making it a preferred tool for long-term persistence and covert cyber espionage. This report provides defenders with actionable insights to detect and interrupt VShell operations. We share global infrastructure tracking techniques, tools to decrypt VShell communications ...

  • VShell — Malware Profile & Detection | BotEraser
    web:boteraser.com

    The malware uses a modular plugin architecture, allowing it to execute arbitrary commands, upload/download files, capture keystrokes, and enumerate network resources.

  • New Linux Malware With Weaponized RAR Archive Deploys VShell Backdoor
    web:cybersecuritynews.com

    New Linux malware uses malicious RAR filenames to drop VShell backdoor via spam surveys, exploiting shell operations & metadata.

  • VShell Malware: Cross-Platform Remote Access Threat
    web:hunt.io

    VShell is an open-source, cross-platform malware designed to grant attackers remote access to compromised systems. It works on Windows, Linux, and macOS platforms, allowing attackers to execute commands, transfer files, and gather system information. VShell is highly customizable, which makes it a flexible and dangerous tool for cybercriminals.

  • VShell malware — IOCs & CVEs | isMalicious
    web:ismalicious.com

    1,755 indicators of compromise attributed to the VShell malware family — domains, IPs, URLs and file hashes, from abuse.ch feeds.

  • VShell (Malware Family) - malpedia.caad.fkie.fraunhofer.de
    web:malpedia.caad.fkie.fraunhofer.de

    VShell is an OST framework written in Go, enabling availability of implants for multiple platforms (Windows, Linux, macOS).

  • ThreatFox | VShell
    web:threatfox.abuse.ch

    ThreatFox Database Indicators of Compromise (IOCs) on ThreatFox are associated with a certain malware fas. A malware sample can be associated with only one malware family. The page below gives you an overview on indicators of compromise associated with win. vshell . You can also get this data through the ThreatFox API. Database Entry

  • ThreatFox | 123.254.106.168:80
    web:threatfox.abuse.ch

    ThreatFox IOC Database You are viewing the ThreatFox database entry for ip:port 123.254.106.168:80. Database Entry This IOC expired This IOC is an old IOC and hence has expired on 2026-09-19 01:15:04 UTC. We therefore refrain from exporting it into our datasets. As a result, this database entry is purely informational and has no impact.

  • UNC5174's evolution in China's ongoing cyber warfare: From SNOWLIGHT to ...
    web:www.sysdig.com

    UNC5174's new campaign Following initial access, a malicious bash script drops two payloads : dnsloger (associated with SNOWLIGHT malware ) and system_worker (associated with Sliver and Cobalt Strike). This step's main focus is establishing persistence by dropping a Sliver implant and an in-memory backdoor ( VShell ) for further exploitation.

  • The Silent, Fileless Threat of VShell - trellix.com
    web:www.trellix.com

    The Silent, Fileless Threat of VShell By Sagar Bade · August 21, 2025 Introduction Linux environments are often seen as bastions of security, favored by developers, sysadmins, and security professionals for their stability, transparency, and resistance to malware . Compared to Windows, the attack surface is perceived to be smaller, and users typically enjoy a greater degree of control. But ...

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.