>samit_hota
Back to IOCs
30 indicators

VShell — Indicators of Compromise

Samit Hota·
#ioc#vshell

Overview

Indicators of compromise associated with VShell. 30 indicators listed below.

Not exhaustive, and confidence varies. Always corroborate against your own telemetry before taking action.

TypeIndicatorFirst SeenConfidence
ip:port47.236.204.56:19999July 21, 2026100%
ip:port149.104.28.77:6000July 17, 2026100%
ip:port132.226.72.148:10000July 17, 2026100%
ip:port5.79.70.5:8084July 16, 2026100%
ip:port38.60.241.251:4443July 16, 2026100%
ip:port162.14.110.164:8084July 15, 2026100%
ip:port107.174.186.201:9090July 15, 2026100%
ip:port34.21.206.134:8080July 15, 2026100%
ip:port121.40.49.4:8084July 15, 2026100%
ip:port115.159.212.178:8443July 15, 2026100%
ip:port38.54.95.51:80July 15, 2026100%
ip:port162.14.110.164:8088July 14, 2026100%
ip:port128.241.231.135:18082July 14, 2026100%
ip:port154.88.97.51:8885July 14, 2026100%
ip:port154.88.96.42:8885July 14, 2026100%
ip:port64.83.17.81:8084July 14, 2026100%
ip:port39.100.88.185:8084July 14, 2026100%
ip:port154.88.97.47:8885July 14, 2026100%
ip:port45.207.194.79:8084July 14, 2026100%
ip:port154.88.96.34:8885July 14, 2026100%
ip:port154.89.148.121:8084July 14, 2026100%
ip:port154.88.96.52:8885July 14, 2026100%
ip:port120.26.236.53:3306July 14, 2026100%
ip:port154.88.96.62:8885July 14, 2026100%
ip:port154.88.96.58:8885July 14, 2026100%
ip:port154.88.96.60:8885July 14, 2026100%
ip:port66.154.104.204:4433July 14, 2026100%
ip:port154.88.97.40:8885July 14, 2026100%
ip:port154.88.97.37:8885July 14, 2026100%
ip:port154.88.97.59:8885July 14, 2026100%

Related content

IOCs

5.t Downloader — Indicators of Compromise

IOCs

ACR Stealer — Indicators of Compromise

IOCs

AdaptixC2 — Indicators of Compromise

IOCs

AdWind — Indicators of Compromise

Seeing these indicators in your logs?

Let's figure out how far it's gotten.

Book an advisory call