Skip to content
Threat Feed
Subscribe
medium advisory

VShell Malware Command and Control Infrastructure

ThreatFox identified 61 new indicators of compromise related to the VShell malware family, including multiple malicious payload hashes and active command-and-control IP addresses.

Triage facts

Revision 1
Evidence
Unknown
Severity
Medium
Action
Elevated
Sources
1 public source
Freshness
Revision 1Nov 5, 13:42 UTC
Detection
3 IOCs
Source quality
A1Likely

On November 4, 2026, ThreatFox published 61 new indicators of compromise associated with the VShell malware family (win.vshell). The identified infrastructure includes 16 IP addresses serving as botnet command-and-control (C2) servers and 45 associated payloads identified by various file hashes. These indicators were reported by multiple contributors and represent active malware infrastructure.

Recommendation

  • Ingest the provided IP addresses into your perimeter blocklists and monitor for outbound connections from internal assets to these addresses.
  • Calculate file hashes for suspicious binaries observed in the environment and compare them against the provided IOC list to detect VShell payload distribution.
  • Conduct retrospective threat hunting in proxy and DNS logs for historical communication with the listed C2 infrastructure.

Immediate actions

Block identified C2 IP addresses at the enterprise edge firewall

SOC 24h

Threat Hunt

Identify endpoints communicating with the listed C2 IP addresses

T1071 high high confidence hunt now

Data: Network proxy logs, Firewall traffic logs

Indicators of compromise

1

hash_sha256

2

ip

TypeValue
ip43.161.243.73
ip165.154.45.137
hash_sha2567a7b1c234c94c4a20540c2be5b94cb193dc16bdb263b6bb11762f25db27bdc30