vshell | 1bc86fd3843315475b6519bb4e62ff3574ea5f2dbefc7a906717226f8712838a

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/09/2026, 11:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1bc86fd3843315475b6519bb4e62ff3574ea5f2dbefc7a906717226f8712838a.exe
Size 3KB
Sample260927-nafc7axyev
SHA256 1bc86fd3843315475b6519bb4e62ff3574ea5f2dbefc7a906717226f8712838a
MD5 47c065e0090dda0e8b15056671fdfaaa
SHA1 73badc1681b45993d2cb7d1062610aa321971f25
SHA512 e66908671178c9b7f5ce9179466d20d9fb887d46cd51e75c2d3dc30940b9d40f03c9d662189108010e42e6208c00a1acde134ad23f4b981fabcfa617a716b668
TLSH
T1A371A74160545AF2D94DE3BF8587B895FD4FB248A2D80B0F07D8981A2F7507BB1D9613
MD5 SHA1 SHA512 TLSH

Score

10^/10

backdoor discovery vshell rat

Malware Config

Extracted

Family

vshell

154.91.63.119

Attributes

port
8094
salt
qwe123qwe
type
tcp
vkey
qwe123qwe

Signatures

Family: VShell
VShell is a cross-platform Go-based RAT and C2 framework targeting Windows and Linux.
backdoor rat vshell

Detects VSHELL Backdoor 1 IoCs

resource	yara_rule
behavioral2/memory/1028-0-0x0000000067700000-0x0000000067ED4000-memory.dmp	family_vshell

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	1bc86fd3843315475b6519bb4e62ff3574ea5f2dbefc7a906717226f8712838a.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	1bc86fd3843315475b6519bb4e62ff3574ea5f2dbefc7a906717226f8712838a.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1028	1bc86fd3843315475b6519bb4e62ff3574ea5f2dbefc7a906717226f8712838a.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1028	1bc86fd3843315475b6519bb4e62ff3574ea5f2dbefc7a906717226f8712838a.exe

C:\Users\Admin\AppData\Local\Temp\1bc86fd3843315475b6519bb4e62ff3574ea5f2dbefc7a906717226f8712838a.exe
"C:\Users\Admin\AppData\Local\Temp\1bc86fd3843315475b6519bb4e62ff3574ea5f2dbefc7a906717226f8712838a.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1028

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1028-9-0x000001EB04F20000-0x000001EB06BBD000-memory.dmp

Download

memory/1028-0-0x0000000067700000-0x0000000067ED4000-memory.dmp

Download

memory/1028-11-0x000001EB04F20000-0x000001EB06BBD000-memory.dmp

Download