TF-1932530
high
📛 Threat Title
VShell: SHA256 hash of a malware sample (payload) 951ad97fb9095b03cf85689bab67a32c8d22e21f09095fce71d922fdd35578ee
Description
Indicator that identifies a malware sample (payload). IOC type: SHA256 hash of a malware sample (payload). Attributed malware: VShell. Confidence: 95. First seen: 2026-09-25 00:42:04 UTC. Reporter: whack_sh. Tags: exe, Vshell.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
hash_sha256
951ad97fb9095b03cf85689bab67a32c8d22e21f09095fce71d922fdd35578ee
IOC database
- Type
- hash_sha256
- Value
951ad97fb9095b03cf85689bab67a32c8d22e21f09095fce71d922fdd35578ee- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- SHA256 hash of a malware sample (payload) attributed to VShell
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
No VirusTotal details cached for this IOC. Open the IOC page to query VirusTotal.
References (2)
- Malpedia profile ThreatFox IOCs
-
ThreatFox IOC page
ThreatFox IOCs
Indicator that identifies a malware sample (payload). IOC type: SHA256 hash of a malware sample (payload). Attributed malware: VShell. Confidence: 95. First seen: 2026-09-25 00:42:04 UTC. Reporter: whack_sh. Tags: exe, Vshell.
Remediations (10)
-
web:bazaar.abuse.ch
You are currently viewing the MalwareBazaar entry for SHA256 951ad97fb9095b03cf85689bab67a32c8d22e21f09095fce71d922fdd35578ee . While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.
-
web:bazaar.abuse.ch
Information on VShell malware sample ( SHA256 a6b9e11dd7457c49ef440964ef625cb34762d94b894e05925f92fc14d1e2b714) You are currently viewing the MalwareBazaar entry for ...
-
web:blog.nviso.eu
VShell has evolved into an offensive backdoor, offering modular design, encrypted communications, and cross-platform support, making it a preferred tool for long-term persistence and covert cyber espionage. This report provides defenders with actionable insights to detect and interrupt VShell operations. We share global infrastructure tracking techniques, tools to decrypt VShell communications ...
-
web:boteraser.com
The malware uses a modular plugin architecture, allowing it to execute arbitrary commands, upload/download files, capture keystrokes, and enumerate network resources.
-
web:cipherssecurity.com
Check MD5, SHA-1, or SHA-256 file hashes against MalwareBazaar and VirusTotal feeds. Drop a file — hashing happens in your browser, never uploaded.
-
web:hunt.io
VShell is an open-source, cross-platform malware designed to grant attackers remote access to compromised systems. It works on Windows, Linux, and macOS platforms, allowing attackers to execute commands, transfer files, and gather system information. VShell is highly customizable, which makes it a flexible and dangerous tool for cybercriminals.
-
web:ismalicious.com
Database of known malware file hashes. MD5, SHA1, and SHA256 hashes with malware family classification. Updated daily from sandbox analysis and vendor feeds.
-
web:threatfox.abuse.ch
VShell IOC: 9ced5fc61e2b93800be8938382d7c9db7d53ae80ac81fbe9aad82fe0ec7efced ( sha256_hash ) You are viewing the ThreatFox database entry for sha256_hash ...
-
web:www.sysdig.com
The SNOWLIGHT malware acts as a dropper for a fileless payload that resides solely in memory, called VShell . VShell is a Remote Access Trojan (RAT) popular among Chinese-speaking cybercriminals in several forums, and its main developer is also a Chinese speaker.
-
web:www.trellix.com
The Silent, Fileless Threat of VShell By Sagar Bade · August 21, 2025 Introduction Linux environments are often seen as bastions of security, favored by developers, sysadmins, and security professionals for their stability, transparency, and resistance to malware . Compared to Windows, the attack surface is perceived to be smaller, and users typically enjoy a greater degree of control. But ...
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.