← Back to SOC feed Coverage →

ThreatFox: VShell IOCs

ioc-hunt HIGH ThreatFox
CommonSecurityLogDeviceNetworkEvents
iocthreatfoxwin-vshell
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at ThreatFox →
Retrieved: 2026-07-14T11:00:00Z · Confidence: high

Hunt Hypothesis

This hunt hypothesis targets adversary behavior involving the execution or network communication of known VShell indicators of compromise (IOCs) to detect potential command-and-control activity or initial access attempts. Proactively hunting for these 24 specific IOCs in Azure Sentinel is critical because it enables the SOC team to identify and contain high-severity threats associated with this malware family before they escalate into broader lateral movements within the enterprise environment.

IOC Summary

Malware Family: VShell Total IOCs: 24 IOC Types: ip:port

TypeValueThreat TypeFirst SeenConfidence
ip:port154[.]88[.]97[.]34:8885botnet_cc2026-07-14100%
ip:port154[.]88[.]97[.]55:8885botnet_cc2026-07-14100%
ip:port154[.]88[.]96[.]45:8885botnet_cc2026-07-14100%
ip:port154[.]88[.]97[.]49:8885botnet_cc2026-07-14100%
ip:port154[.]88[.]97[.]48:8885botnet_cc2026-07-14100%
ip:port154[.]88[.]96[.]50:8885botnet_cc2026-07-14100%
ip:port154[.]88[.]97[.]61:8885botnet_cc2026-07-14100%
ip:port154[.]88[.]97[.]57:8885botnet_cc2026-07-14100%
ip:port154[.]88[.]96[.]37:8885botnet_cc2026-07-14100%
ip:port154[.]88[.]97[.]33:8885botnet_cc2026-07-14100%
ip:port154[.]88[.]97[.]50:8885botnet_cc2026-07-14100%
ip:port154[.]88[.]96[.]43:8885botnet_cc2026-07-14100%
ip:port154[.]88[.]97[.]53:8885botnet_cc2026-07-14100%
ip:port154[.]88[.]96[.]33:8885botnet_cc2026-07-14100%
ip:port45[.]197[.]36[.]34:8885botnet_cc2026-07-14100%
ip:port154[.]88[.]97[.]39:8885botnet_cc2026-07-14100%
ip:port154[.]88[.]96[.]55:8885botnet_cc2026-07-14100%
ip:port43[.]161[.]215[.]33:21botnet_cc2026-07-14100%
ip:port154[.]88[.]96[.]40:8885botnet_cc2026-07-14100%
ip:port154[.]88[.]96[.]61:8885botnet_cc2026-07-14100%
ip:port154[.]88[.]96[.]35:8885botnet_cc2026-07-14100%
ip:port154[.]88[.]96[.]57:8885botnet_cc2026-07-14100%
ip:port38[.]14[.]212[.]71:8888botnet_cc2026-07-13100%
ip:port154[.]88[.]96[.]59:8885botnet_cc2026-07-13100%

KQL: Ip Hunt

// Hunt for network connections to known malicious IPs
// Source: ThreatFox - VShell
let malicious_ips = dynamic(["154.88.97.33", "43.161.215.33", "38.14.212.71", "154.88.96.50", "154.88.96.40", "154.88.96.43", "154.88.97.49", "154.88.97.50", "154.88.96.57", "154.88.97.57", "154.88.96.59", "154.88.97.48", "154.88.96.45", "154.88.96.35", "45.197.36.34", "154.88.96.61", "154.88.97.39", "154.88.97.55", "154.88.96.55", "154.88.97.61", "154.88.96.37", "154.88.97.34", "154.88.97.53", "154.88.96.33"]);
CommonSecurityLog
| where DestinationIP in (malicious_ips) or SourceIP in (malicious_ips)
| project TimeGenerated, SourceIP, DestinationIP, DestinationPort, DeviceAction, Activity
| order by TimeGenerated desc

KQL: Ip Hunt Device

// Hunt in Defender for Endpoint network events
let malicious_ips = dynamic(["154.88.97.33", "43.161.215.33", "38.14.212.71", "154.88.96.50", "154.88.96.40", "154.88.96.43", "154.88.97.49", "154.88.97.50", "154.88.96.57", "154.88.97.57", "154.88.96.59", "154.88.97.48", "154.88.96.45", "154.88.96.35", "45.197.36.34", "154.88.96.61", "154.88.97.39", "154.88.97.55", "154.88.96.55", "154.88.97.61", "154.88.96.37", "154.88.97.34", "154.88.97.53", "154.88.96.33"]);
DeviceNetworkEvents
| where RemoteIP in (malicious_ips)
| project Timestamp, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName, ActionType
| order by Timestamp desc

Required Data Sources

Sentinel TableNotes
CommonSecurityLogEnsure this data connector is enabled
DeviceNetworkEventsEnsure this data connector is enabled

References

False Positive Guidance

Here are 5 specific false positive scenarios for the ThreatFox: VShell IOCs detection rule in an enterprise environment, along with suggested filters or exclusions:

Original source: https://threatfox.abuse.ch/browse/malware/win.vshell/