This hunt targets the presence of VShell, a lightweight reverse shell tool frequently used by adversaries to establish covert command-and-control channels and execute post-exploitation actions. Proactively hunting for these IOCs in Azure Sentinel is critical to detect early-stage intrusions and prevent attackers from leveraging this tool for lateral movement or data exfiltration before they can escalate privileges.
Malware Family: VShell Total IOCs: 24 IOC Types: sha256_hash, ip:port
| Type | Value | Threat Type | First Seen | Confidence |
|---|---|---|---|---|
| ip:port | 154[.]91[.]60[.]103:8074 | botnet_cc | 2026-09-12 | 100% |
| ip:port | 154[.]91[.]59[.]123:8074 | botnet_cc | 2026-09-12 | 100% |
| ip:port | 154[.]91[.]59[.]122:8074 | botnet_cc | 2026-09-12 | 100% |
| ip:port | 154[.]91[.]59[.]107:8074 | botnet_cc | 2026-09-12 | 100% |
| ip:port | 154[.]91[.]59[.]105:8074 | botnet_cc | 2026-09-12 | 100% |
| ip:port | 154[.]91[.]58[.]123:8074 | botnet_cc | 2026-09-12 | 100% |
| ip:port | 154[.]91[.]58[.]116:8074 | botnet_cc | 2026-09-12 | 100% |
| ip:port | 154[.]91[.]58[.]120:8074 | botnet_cc | 2026-09-12 | 100% |
| ip:port | 154[.]91[.]58[.]121:8074 | botnet_cc | 2026-09-12 | 100% |
| ip:port | 154[.]91[.]57[.]114:8074 | botnet_cc | 2026-09-12 | 100% |
| sha256_hash | 3e7d4140d6032515c6d19b25ee836c522519935db8b54d350020f94f744c5281 | payload | 2026-09-12 | 95% |
| sha256_hash | e12dbf049019f00e5ad30e55e04314a080491617cca6b099d81334ae43458dd6 | payload | 2026-09-12 | 95% |
| sha256_hash | f341190f94840430742555f0ef402c162ab7fe5cd736923cb579a1ae33be47e3 | payload | 2026-09-12 | 90% |
| ip:port | 154[.]91[.]58[.]115:8074 | botnet_cc | 2026-09-12 | 100% |
| ip:port | 154[.]91[.]57[.]120:8074 | botnet_cc | 2026-09-12 | 100% |
| ip:port | 154[.]91[.]57[.]117:8074 | botnet_cc | 2026-09-12 | 100% |
| ip:port | 154[.]91[.]57[.]116:8074 | botnet_cc | 2026-09-12 | 100% |
| ip:port | 154[.]91[.]57[.]113:8074 | botnet_cc | 2026-09-12 | 100% |
| ip:port | 154[.]91[.]57[.]110:8074 | botnet_cc | 2026-09-12 | 100% |
| ip:port | 154[.]91[.]58[.]108:8074 | botnet_cc | 2026-09-12 | 100% |
| ip:port | 154[.]91[.]58[.]109:8074 | botnet_cc | 2026-09-12 | 100% |
| ip:port | 134[.]255[.]211[.]140:9300 | botnet_cc | 2026-09-12 | 100% |
| ip:port | 154[.]91[.]57[.]122:8074 | botnet_cc | 2026-09-12 | 100% |
| ip:port | 154[.]91[.]57[.]100:8074 | botnet_cc | 2026-09-12 | 100% |
// Hunt for network connections to known malicious IPs
// Source: ThreatFox - VShell
let malicious_ips = dynamic(["154.91.58.108", "154.91.58.109", "154.91.57.114", "134.255.211.140", "154.91.58.116", "154.91.59.122", "154.91.57.113", "154.91.59.105", "154.91.58.121", "154.91.57.100", "154.91.57.116", "154.91.58.120", "154.91.59.123", "154.91.59.107", "154.91.58.123", "154.91.57.120", "154.91.58.115", "154.91.57.117", "154.91.57.122", "154.91.57.110", "154.91.60.103"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["154.91.58.108", "154.91.58.109", "154.91.57.114", "134.255.211.140", "154.91.58.116", "154.91.59.122", "154.91.57.113", "154.91.59.105", "154.91.58.121", "154.91.57.100", "154.91.57.116", "154.91.58.120", "154.91.59.123", "154.91.59.107", "154.91.58.123", "154.91.57.120", "154.91.58.115", "154.91.57.117", "154.91.57.122", "154.91.57.110", "154.91.60.103"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc// Hunt for files matching known malicious hashes
// Source: ThreatFox - VShell
let malicious_hashes = dynamic(["3e7d4140d6032515c6d19b25ee836c522519935db8b54d350020f94f744c5281", "e12dbf049019f00e5ad30e55e04314a080491617cca6b099d81334ae43458dd6", "f341190f94840430742555f0ef402c162ab7fe5cd736923cb579a1ae33be47e3"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc| Sentinel Table | Notes |
|---|---|
CommonSecurityLog | Ensure this data connector is enabled |
DeviceFileEvents | Ensure this data connector is enabled |
DeviceNetworkEvents | Ensure this data connector is enabled |
vshell as a lightweight, cross-platform SSH alternative for ad-hoc remote troubleshooting on Linux servers, bypassing the standard ssh client to avoid key management overhead during incident response.
conhost.exe, cmd.exe, bash, zsh) and the command line arguments contain typical SSH-like flags (e.g., -p, -o, -i) or connect to standard SSH ports (22, 2222).vshell binary from an internal artifact repository to perform remote file synchronization or configuration deployment to target nodes.
jenkins, gitlab-runner, ci-service) or where the working directory is within a standard build workspace path (e.g., /var/lib/jenkins/workspace/, C:\Jenkins\workspace\).vshell to remotely execute df -h or systemctl status commands across a fleet of microservices containers for disk usage and service health checks.
df, ps, systemctl status, cat /etc/os-release) and the process is initiated by a scheduled task or cron job owned by a service account (e.g., audit-service, monitoring-agent).