ThreatFox: VShell IOCs | SOC Hunt Feed

Hunt Hypothesis

This hunt targets the presence of VShell, a lightweight web shell often used by adversaries to establish persistent access and execute commands on compromised web servers. Proactively hunting for these IOCs in Azure Sentinel allows the SOC to identify stealthy backdoors that may evade standard monitoring, enabling rapid containment before the attacker leverages the web shell for lateral movement or data exfiltration.

IOC Summary

Malware Family: VShell Total IOCs: 30 IOC Types: ip:port, url, sha256_hash

Type	Value	Threat Type	First Seen	Confidence
ip:port	`103[.]124[.]157[.]49:8084`	botnet_cc	2026-09-20	100%
ip:port	`154[.]91[.]57[.]116:8084`	botnet_cc	2026-09-20	100%
ip:port	`106[.]15[.]205[.]15:8888`	botnet_cc	2026-09-20	100%
ip:port	`101[.]42[.]186[.]233:8092`	botnet_cc	2026-09-20	100%
ip:port	`8[.]145[.]60[.]56:8084`	botnet_cc	2026-09-20	100%
ip:port	`81[.]70[.]143[.]19:4567`	botnet_cc	2026-09-20	100%
url	`hxxp://107[.]161[.]168[.]217/?h=107[.]161[.]168[.]217&p=80&t=ws&a=w64&stage=true`	payload_delivery	2026-09-20	95%
sha256_hash	`1de56b92dcd90c85d8335e8aa9aaa90dc493820d5a638364e7c5b326b5db675a`	payload	2026-09-20	95%
sha256_hash	`dc14e112591d6af5e028771c5921a4bfe9f6aa1489e46c8537651892104c44f4`	payload	2026-09-20	95%
sha256_hash	`c3c6f56bd4bfe3c957640b471c0017a9faa62379b98adf933da3905c64c516bc`	payload	2026-09-20	95%
sha256_hash	`0d6516841483942e02985cd0da5071b684226bbc89afac5fd6a27a476336acd8`	payload	2026-09-20	95%
url	`hxxp://47[.]254[.]173[.]184:8443/?h=47[.]254[.]173[.]184&p=8443&t=tcp&a=w32&stage=true`	payload_delivery	2026-09-20	95%
url	`hxxp://47[.]254[.]173[.]184:8443/?h=47[.]254[.]173[.]184&p=8443&t=ws&a=w32&stage=true`	payload_delivery	2026-09-20	95%
url	`hxxp://89[.]34[.]227[.]96:8088/?h=89[.]34[.]227[.]96&p=8088&t=tcp&a=w32&stage=true`	payload_delivery	2026-09-20	95%
url	`hxxp://89[.]34[.]227[.]96:8088/?h=89[.]34[.]227[.]96&p=8088&t=tcp&a=w64&stage=true`	payload_delivery	2026-09-20	95%
url	`hxxp://89[.]34[.]227[.]96:8088/?h=89[.]34[.]227[.]96&p=8088&t=ws&a=w32&stage=true`	payload_delivery	2026-09-20	95%
sha256_hash	`5c93b5acf69d903e4a3b82d93d0b4dfd0f0421d01899e2dbd19b42dc90b662ca`	payload	2026-09-20	95%
sha256_hash	`c63795af3f664de95aacf2a1829805c5d04be7e79524f511b15f6a85453aa6f0`	payload	2026-09-20	95%
sha256_hash	`e46795ecf21f16b7ff23f8a5b06cbdb560255df8d7a5d083f6434dcdd3fc6628`	payload	2026-09-20	95%
sha256_hash	`17c23b9917d2e02b6282e3b7c80a1c0dc40e8ba8385a7f108b3d490ba56b23e1`	payload	2026-09-20	95%
sha256_hash	`d4a1d31071219e052098223e88b0bc28bb78cc47fb0b6aa8cddf4ceff36ef556`	payload	2026-09-20	95%
url	`hxxp://107[.]161[.]168[.]217/?h=107[.]161[.]168[.]217&p=80&t=ws&a=w32&stage=true`	payload_delivery	2026-09-20	95%
url	`hxxp://89[.]34[.]227[.]96:8088/?h=89[.]34[.]227[.]96&p=8088&t=ws&a=w64&stage=true`	payload_delivery	2026-09-20	95%
ip:port	`154[.]91[.]63[.]109:8084`	botnet_cc	2026-09-20	100%
ip:port	`123[.]207[.]246[.]48:8084`	botnet_cc	2026-09-20	100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - VShell
let malicious_ips = dynamic(["154.12.37.146", "154.91.59.115", "106.15.205.15", "154.91.59.114", "101.42.186.233", "154.91.62.103", "103.124.157.49", "8.145.60.56", "123.207.246.48", "154.91.57.126", "154.91.57.116", "81.70.143.19", "154.91.63.109"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["154.12.37.146", "154.91.59.115", "106.15.205.15", "154.91.59.114", "101.42.186.233", "154.91.62.103", "103.124.157.49", "8.145.60.56", "123.207.246.48", "154.91.57.126", "154.91.57.116", "81.70.143.19", "154.91.63.109"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

KQL: Url Hunt

// Hunt for access to known malicious URLs
// Source: ThreatFox - VShell
let malicious_urls = dynamic(["http://107.161.168.217/?h=107.161.168.217&p=80&t=ws&a=w64&stage=true", "http://47.254.173.184:8443/?h=47.254.173.184&p=8443&t=tcp&a=w32&stage=true", "http://47.254.173.184:8443/?h=47.254.173.184&p=8443&t=ws&a=w32&stage=true", "http://89.34.227.96:8088/?h=89.34.227.96&p=8088&t=tcp&a=w32&stage=true", "http://89.34.227.96:8088/?h=89.34.227.96&p=8088&t=tcp&a=w64&stage=true", "http://89.34.227.96:8088/?h=89.34.227.96&p=8088&t=ws&a=w32&stage=true", "http://107.161.168.217/?h=107.161.168.217&p=80&t=ws&a=w32&stage=true", "http://89.34.227.96:8088/?h=89.34.227.96&p=8088&t=ws&a=w64&stage=true"]);
UrlClickEvents
| where Url has_any (malicious_urls)
| project Timestamp, AccountUpn, Url, ActionType, IsClickedThrough
| order by Timestamp desc

KQL: Hash Hunt

// Hunt for files matching known malicious hashes
// Source: ThreatFox - VShell
let malicious_hashes = dynamic(["1de56b92dcd90c85d8335e8aa9aaa90dc493820d5a638364e7c5b326b5db675a", "dc14e112591d6af5e028771c5921a4bfe9f6aa1489e46c8537651892104c44f4", "c3c6f56bd4bfe3c957640b471c0017a9faa62379b98adf933da3905c64c516bc", "0d6516841483942e02985cd0da5071b684226bbc89afac5fd6a27a476336acd8", "5c93b5acf69d903e4a3b82d93d0b4dfd0f0421d01899e2dbd19b42dc90b662ca", "c63795af3f664de95aacf2a1829805c5d04be7e79524f511b15f6a85453aa6f0", "e46795ecf21f16b7ff23f8a5b06cbdb560255df8d7a5d083f6434dcdd3fc6628", "17c23b9917d2e02b6282e3b7c80a1c0dc40e8ba8385a7f108b3d490ba56b23e1", "d4a1d31071219e052098223e88b0bc28bb78cc47fb0b6aa8cddf4ceff36ef556"]);
DeviceFileEvents
| where SHA256 in (malicious_hashes) or SHA1 in (malicious_hashes) or MD5 in (malicious_hashes)
| project Timestamp, DeviceName, FileName, FolderPath, SHA256, InitiatingProcessFileName
| order by Timestamp desc

Required Data Sources

Sentinel Table	Notes
`CommonSecurityLog`	Ensure this data connector is enabled
`DeviceFileEvents`	Ensure this data connector is enabled
`DeviceNetworkEvents`	Ensure this data connector is enabled
`UrlClickEvents`	Ensure this data connector is enabled

References

ThreatFox — VShell

False Positive Guidance

Legacy Application Maintenance: Administrators performing maintenance on legacy Java or .NET applications may intentionally deploy test instances of VShell (or similar lightweight shells) to verify port connectivity and firewall rules before deploying the final application.
- Filter/Exclusion: Exclude hosts where the VShell process is spawned by a known application installer (e.g., msiexec.exe, setup.exe) or where the parent process is a recognized build tool (e.g., msbuild.exe, gradle).
Developer Localhost Testing: Developers running local web servers or API gateways on their workstations may use VShell as a quick, lightweight HTTP server for local debugging, often binding to 127.0.0.1 or localhost.
- Filter/Exclusion: Exclude alerts where the network connection is established on the loopback interface (127.0.0.1 or ::1) and the user account belongs to the Developers or Engineering security group.
CI/CD Pipeline Artifacts: Continuous Integration pipelines that build and package container images or application bundles may temporarily download or extract VShell binaries as part of a dependency check or smoke test, especially if the pipeline uses a generic “shell” utility for script execution.
- Filter/Exclusion: Exclude processes running within known CI/CD agent directories (e.g., C:\Program Files\Jenkins\, /var/lib/jenkins/) or where the parent process is a known CI agent binary (e.g., jenkins-agent, drone-runner).
IT Support Remote Troubleshooting: IT support staff may use VShell as a temporary, low-footprint remote access tool to troubleshoot network issues or verify service availability on user endpoints, particularly when standard RDP or SSH is unavailable.
- *Filter/Exclusion