Overview

overview

10

Static

static

3

69772ac131...0f.exe

windows10-2004-x64

10

69772ac131...0f.exe

windows11-ltsc_2024-x64

6

Sharing

Copy URL Twitter E-mail

General

  • Target
    69772ac131b46c832f6add55dcfed4f484e3c8d9af42cff9921457bebd5a9f0f
  • Size 503KB
  • Sample260908-kl49xavydx
  • SHA256 69772ac131b46c832f6add55dcfed4f484e3c8d9af42cff9921457bebd5a9f0f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
vshellbackdoorpersistencerat

Malware Config

Extracted

Family

  • vshell

C2

  • ws://w1.topayapp.org

Attributes
  • port

    65512

  • salt

    qwe123qwe123

  • type

    ws

  • vkey

    qwe123qwe123

Targets

    • Target
      69772ac131b46c832f6add55dcfed4f484e3c8d9af42cff9921457bebd5a9f0f
    • Size 503KB
    • SHA256 69772ac131b46c832f6add55dcfed4f484e3c8d9af42cff9921457bebd5a9f0f
    • MD5 SHA1 SHA512 SSDEEP TLSH
    Score
    10/10
    backdoorvshellpersistencerat

    • Detects VSHELL Backdoor

    • Family: VShell

      VShell is a cross-platform Go-based RAT and C2 framework targeting Windows and Linux.

      backdoorratvshell

    • Executes dropped EXE

    • Adds Run key to start application

      persistence
    behavioral1behavioral2

MITRE ATT&CK Enterprise v16

Tasks