vshell | 72d6bdce7b0018554dc012112c2ca58aea987a52dca5073bc792222a8fad8d6e

General

Target
windows.bat
Size 493B
Sample260927-g63p2aae76
SHA256 72d6bdce7b0018554dc012112c2ca58aea987a52dca5073bc792222a8fad8d6e
MD5 3528a5ff4dd730963ef8b9ef29d33e8e
SHA1 684f4dd098da9e93f8b1e50ea8cad7853719a684
SHA512 97bd0b86b721c38646694bfa8489123de4d87dbd4eceb775cd14762952c59e90586865cd624879f6cd312d15c05d35e1d6d1d820850e83e3d41cc3d7f7c2509d
TLSH
T1CAF0D48DE45115700FD7D967B69078C1F35940C24A20C4C4BCD432D98ECD69A39EF6C3
MD5 SHA1 SHA512 TLSH

Score

10^/10

Malware Config

Extracted

Family

vshell

C2

ws://43.136.40.48

Attributes

port
8088
salt
qwe123qwe
type
ws
vkey
qwe123qwe

Targets

- Target
  windows.bat
- Size 493B
- SHA256 72d6bdce7b0018554dc012112c2ca58aea987a52dca5073bc792222a8fad8d6e
- MD5 3528a5ff4dd730963ef8b9ef29d33e8e
- SHA1 684f4dd098da9e93f8b1e50ea8cad7853719a684
- SHA512 97bd0b86b721c38646694bfa8489123de4d87dbd4eceb775cd14762952c59e90586865cd624879f6cd312d15c05d35e1d6d1d820850e83e3d41cc3d7f7c2509d
- TLSH
  T1CAF0D48DE45115700FD7D967B69078C1F35940C24A20C4C4BCD432D98ECD69A39EF6C3
- MD5 SHA1 SHA512 TLSH
Score

10^/10

backdoor discovery execution vshell rat
- Detects VSHELL Backdoor
- Family: VShell
  VShell is a cross-platform Go-based RAT and C2 framework targeting Windows and Linux.
  backdoor rat vshell
- Downloads MZ/PE file
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detects VSHELL Backdoor

Family: VShell

Downloads MZ/PE file

Executes dropped EXE

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2