vshell | df328c13cc35ff63de0b44726fb4b387d387ab5e7ad70c207e366ba0d9cb001d

General

Target
windows.bat
Size 500B
Sample260925-w6fb3axtax
SHA256 df328c13cc35ff63de0b44726fb4b387d387ab5e7ad70c207e366ba0d9cb001d
MD5 25bd96a951a8f78f048833bec2a4ed1a
SHA1 e56035022a42f2b6d7d48d8898ce6555d0d63a08
SHA512 7d7ad65879f152aa3d56994413e26f89ae6e5644c63008291cfca0ac803d2917a19462558fecbb5fc9162fba9caf56e3dcdea724a8bc1462b825bb0eee5254b3
TLSH
T190F0978D083104F117C2E90B78E471C1B0CAAC854E3064986C8129DEBEC80A832FAA97
MD5 SHA1 SHA512 TLSH

Score

10^/10

Malware Config

Extracted

Family

vshell

C2

39.104.48.247

Attributes

port
9999
salt
qwe123qwe
type
ws
vkey
qwe123qwe

Targets

- Target
  windows.bat
- Size 500B
- SHA256 df328c13cc35ff63de0b44726fb4b387d387ab5e7ad70c207e366ba0d9cb001d
- MD5 25bd96a951a8f78f048833bec2a4ed1a
- SHA1 e56035022a42f2b6d7d48d8898ce6555d0d63a08
- SHA512 7d7ad65879f152aa3d56994413e26f89ae6e5644c63008291cfca0ac803d2917a19462558fecbb5fc9162fba9caf56e3dcdea724a8bc1462b825bb0eee5254b3
- TLSH
  T190F0978D083104F117C2E90B78E471C1B0CAAC854E3064986C8129DEBEC80A832FAA97
- MD5 SHA1 SHA512 TLSH
Score

10^/10

backdoor discovery execution vshell rat
- Detects VSHELL Backdoor
- Family: VShell
  VShell is a cross-platform Go-based RAT and C2 framework targeting Windows and Linux.
  backdoor rat vshell
- Downloads MZ/PE file
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detects VSHELL Backdoor

Family: VShell

Downloads MZ/PE file

Executes dropped EXE

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2