ThreatFox IOC Database

You are viewing the ThreatFox database entry for url http://139.99.135.67:19999/?h=139.99.135.67&p=19999&t=ws&a=w64&stage=true.

Database Entry

IOC ID:	1945210
IOC:	http://139.99.135.67:19999/?h=139.99.135.67&p=19999&t=ws&a=w64&stage=true
IOC Type :	url
Threat Type :	payload_delivery
Malware:	VShell
Confidence Level :	Confidence level is high (95%)
Is compromised? :	True
ASN:	AS16276 OVH
Country:	FR
First seen:	2026-10-02 07:40:14 UTC
Last seen:	never
UUID:	819c2f58-be34-11f1-9be1-42010aa4000a
Reporter	whack_sh
Reward	5 credits from ThreatFox
Tags:	exe Loader Vshell

whack_sh

Multi-vantage capture (datacenter/residential/mobile); payload SHA-256 27ae3159b8da864cab010d28145efdea472dde225a3454993b9dc0e85bd5dbb0; partner feed labels it vshell; 45 VirusTotal engines malicious; re-verified serving the same bytes at submission time

Malware Samples

The table below documents recent malware samples observed that are associated with this indicator of compromise (IOC).