ThreatFox: VShell IOCs

Hunt Hypothesis

This hunt targets the presence of VShell, a lightweight web-based shell that adversaries deploy to establish persistent remote access and execute commands within compromised Azure environments. Proactively hunting for these IOCs is critical because VShell often operates in user space with minimal footprint, allowing attackers to bypass traditional network controls and maintain stealthy footholds for lateral movement or data exfiltration.

IOC Summary

Malware Family: VShell Total IOCs: 22 IOC Types: ip:port, md5_hash, sha1_hash, sha256_hash

Type	Value	Threat Type	First Seen	Confidence
ip:port	154[.]91[.]59[.]118:8094	botnet_cc	2026-09-08	100%
ip:port	154[.]91[.]60[.]126:8094	botnet_cc	2026-09-08	100%
ip:port	154[.]91[.]61[.]99:8094	botnet_cc	2026-09-08	100%
ip:port	154[.]91[.]59[.]119:8094	botnet_cc	2026-09-08	100%
ip:port	154[.]91[.]63[.]108:8094	botnet_cc	2026-09-08	100%
ip:port	154[.]91[.]63[.]109:8094	botnet_cc	2026-09-08	100%
ip:port	154[.]91[.]63[.]105:8094	botnet_cc	2026-09-08	100%
ip:port	154[.]91[.]61[.]106:8094	botnet_cc	2026-09-08	100%
ip:port	154[.]91[.]63[.]100:8094	botnet_cc	2026-09-08	100%
ip:port	154[.]91[.]61[.]105:8094	botnet_cc	2026-09-08	100%
ip:port	154[.]91[.]61[.]103:8094	botnet_cc	2026-09-08	100%
ip:port	154[.]91[.]61[.]102:8094	botnet_cc	2026-09-08	100%
ip:port	154[.]91[.]61[.]101:8094	botnet_cc	2026-09-08	100%
ip:port	154[.]91[.]61[.]100:8094	botnet_cc	2026-09-08	100%
ip:port	154[.]91[.]61[.]114:8094	botnet_cc	2026-09-08	100%
ip:port	154[.]91[.]61[.]115:8094	botnet_cc	2026-09-08	100%
ip:port	154[.]91[.]61[.]125:8094	botnet_cc	2026-09-08	100%
ip:port	154[.]91[.]61[.]116:8094	botnet_cc	2026-09-08	100%
ip:port	154[.]91[.]60[.]99:8094	botnet_cc	2026-09-08	100%
sha1_hash	1a9cd178c20f433c090db2cd998b6e23875fbda6	payload	2026-09-08	95%
md5_hash	81f40cf86a0398fa67c831f204ba186b	payload	2026-09-08	95%
sha256_hash	8cf3cf35c95976b94178dba716adf5308d54f9226e90413f43dbff681afd5842	payload	2026-09-08	95%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - VShell
let malicious_ips = dynamic(["154.91.61.103", "154.91.63.108", "154.91.61.100", "154.91.63.100", "154.91.63.109", "154.91.61.105", "154.91.61.115", "154.91.61.116", "154.91.59.119", "154.91.61.125", "154.91.61.102", "154.91.61.106", "154.91.61.101", "154.91.61.114", "154.91.60.99", "154.91.63.105", "154.91.61.99", "154.91.60.126", "154.91.59.118"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["154.91.61.103", "154.91.63.108", "154.91.61.100", "154.91.63.100", "154.91.63.109", "154.91.61.105", "154.91.61.115", "154.91.61.116", "154.91.59.119", "154.91.61.125", "154.91.61.102", "154.91.61.106", "154.91.61.101", "154.91.61.114", "154.91.60.99", "154.91.63.105", "154.91.61.99", "154.91.60.126", "154.91.59.118"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - VShell
let malicious_hashes = dynamic(["1a9cd178c20f433c090db2cd998b6e23875fbda6", "81f40cf86a0398fa67c831f204ba186b", "8cf3cf35c95976b94178dba716adf5308d54f9226e90413f43dbff681afd5842"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
CommonSecurityLog	Ensure this data connector is enabled
DeviceFileEvents	Ensure this data connector is enabled
DeviceNetworkEvents	Ensure this data connector is enabled

References

• ThreatFox — VShell

False Positive Guidance

• Scenario: A DevOps engineer uses vshell (or a similar lightweight shell wrapper like mshell or vsh variants) as a local utility for testing SSH key generation, port forwarding, or simple file transfer scripts during a CI/CD pipeline debug session.
  • Filter/Exclusion: Exclude events where the process path matches C:\Users\<user>\AppData\Local\Temp\ or C:\tools\devutils\ AND the parent process is a recognized build tool (e.g., powershell.exe, cmd.exe, git.exe, or docker.exe).
• Scenario: An IT administrator installs a third-party remote management agent (e.g., TeamViewer, AnyDesk, or a custom internal tool) that bundles a VShell-based helper component for low-level system access, placing the binary in a standard installation directory.
  • Filter/Exclusion: Exclude IOCs where the file path contains C:\Program Files\ or C:\Program Files (x86)\ AND the parent process is a known service host (e.g., svchost.exe, services.exe) or a recognized RMM agent process.
• Scenario: A security team runs a scheduled vulnerability scan or endpoint detection test using a tool that includes VShell IOCs as part of its detection logic or test payload, triggering the rule during a routine Monday morning scan.
  • Filter/Exclusion: Exclude events where the process name matches known scanner binaries (e.g., nmap.exe, qualysagent.exe, crowdstrikeagent.exe) OR where the event timestamp falls within a defined maintenance window (e.g., 02:00–04:00 UTC) AND the user account is a service account (e.g., svc-scanner, admin-test).
• **Scenario