vshell | 50e1bce04677f0beabbd94fade5f074d0f3a454bf4cae211d3d660147524668e

General

Target
windows.bat
Size 504B
Sample260926-wygvxsys7p
SHA256 50e1bce04677f0beabbd94fade5f074d0f3a454bf4cae211d3d660147524668e
MD5 b5dd0de95fe8f4764ab5ae401443c405
SHA1 8a34c09ac5b8fc0b21467922da8ed73843436dbf
SHA512 3c8b1ec301321ab90cc025753d7ce2b488fd22b8a9b24c8affd0f6c11cb9a5f8ede3b7f501aee9379451df139426252a52535b927b3bf6e97fd3f47dd1f8e9b7
TLSH
T1D2F0059C14190CB407CAC5037451B8C0B08D00D2CF706D1E68C354DA1E461482BEF7C1
MD5 SHA1 SHA512 TLSH

Score

10^/10

Malware Config

Extracted

Family

vshell

C2

122.51.155.216

Attributes

port
8084
salt
qwe123qwe
type
tcp
vkey
qwe123qwe

Targets

- Target
  windows.bat
- Size 504B
- SHA256 50e1bce04677f0beabbd94fade5f074d0f3a454bf4cae211d3d660147524668e
- MD5 b5dd0de95fe8f4764ab5ae401443c405
- SHA1 8a34c09ac5b8fc0b21467922da8ed73843436dbf
- SHA512 3c8b1ec301321ab90cc025753d7ce2b488fd22b8a9b24c8affd0f6c11cb9a5f8ede3b7f501aee9379451df139426252a52535b927b3bf6e97fd3f47dd1f8e9b7
- TLSH
  T1D2F0059C14190CB407CAC5037451B8C0B08D00D2CF706D1E68C354DA1E461482BEF7C1
- MD5 SHA1 SHA512 TLSH
Score

10^/10

backdoor discovery execution vshell rat
- Detects VSHELL Backdoor
- Family: VShell
  VShell is a cross-platform Go-based RAT and C2 framework targeting Windows and Linux.
  backdoor rat vshell
- Downloads MZ/PE file
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detects VSHELL Backdoor

Family: VShell

Downloads MZ/PE file

Executes dropped EXE

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2