TF-1932532
high
📛 Threat Title
VShell: SHA256 hash of a malware sample (payload) 1e3edeedec4ad242ed9faf8cb370df96aabe95c1d706d0b1b67cf4042da25fb3
Description
Indicator that identifies a malware sample (payload). IOC type: SHA256 hash of a malware sample (payload). Attributed malware: VShell. Confidence: 95. First seen: 2026-09-25 00:42:06 UTC. Reporter: whack_sh. Tags: exe, Vshell.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
hash_sha256
1e3edeedec4ad242ed9faf8cb370df96aabe95c1d706d0b1b67cf4042da25fb3
IOC database
- Type
- hash_sha256
- Value
1e3edeedec4ad242ed9faf8cb370df96aabe95c1d706d0b1b67cf4042da25fb3- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- SHA256 hash of a malware sample (payload) attributed to VShell
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (2)
- Malpedia profile ThreatFox IOCs
-
ThreatFox IOC page
ThreatFox IOCs
Indicator that identifies a malware sample (payload). IOC type: SHA256 hash of a malware sample (payload). Attributed malware: VShell. Confidence: 95. First seen: 2026-09-25 00:42:06 UTC. Reporter: whack_sh. Tags: exe, Vshell.
Remediations (10)
-
web:bazaar.abuse.ch
Information on VShell malware sample ( SHA256 1f08e8d9dd5374a4df8ae963daf20928faaeee5985eed99cb741f89fafce62fa)
-
web:bazaar.abuse.ch
Information on VShell malware sample ( SHA256 63a406d6fb2be2206a48d451ecd67e3ef9199dec0e0cff60583e713fd4401df5) MalwareBazaar Database You are currently viewing the ...
-
web:blog.nviso.eu
VShell has evolved into an offensive backdoor, offering modular design, encrypted communications, and cross-platform support, making it a preferred tool for long-term persistence and covert cyber espionage. This report provides defenders with actionable insights to detect and interrupt VShell operations. We share global infrastructure tracking techniques, tools to decrypt VShell communications ...
-
web:boteraser.com
File-based IOCs include SHA-256 hashes for loader DLLs such as vmtools.dll (e.g., 2a8c6f1b9e3d7f4a0c5b2e8d1f6a3b9c7d0e4f5a6b7c8d9e0f1a2b3c4d5e6f). Behavioral indicators in MITRE ATT&CK (T1055.012—Process Hollowing, T1543.003—Windows Service) show creation of services named VShellHelper or VMwareToolsService pointing to non-standard paths.
-
web:github.com
Malware - Hash -Database aims to provide a centralized collection of malware hashes for use in cybersecurity research, threat intelligence, and digital forensics. By maintaining a diverse set of hash types and regularly updating the repository, we aim to support professionals in identifying and analyzing malware threats effectively.
-
web:hunt.io
VShell is an open-source, cross-platform malware designed to grant attackers remote access to compromised systems. It works on Windows, Linux, and macOS platforms, allowing attackers to execute commands, transfer files, and gather system information. VShell is highly customizable, which makes it a flexible and dangerous tool for cybercriminals.
-
web:ismalicious.com
Database of known malware file hashes. MD5, SHA1, and SHA256 hashes with malware family classification. Updated daily from sandbox analysis and vendor feeds.
-
web:malpedia.caad.fkie.fraunhofer.de
VShell is an OST framework written in Go, enabling availability of implants for multiple platforms (Windows, Linux, macOS).
-
web:threatfox.abuse.ch
VShell IOC: 9ced5fc61e2b93800be8938382d7c9db7d53ae80ac81fbe9aad82fe0ec7efced ( sha256_hash ) You are viewing the ThreatFox database entry for sha256_hash ...
-
web:www.trellix.com
Final payload : VShell malware VShell malware is a Go-based backdoor used primarily by Chinese APT groups for remote access, file operations, and post-exploitation control on infected systems especially Linux servers.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.