vshell | e9649fbe4c83efe5321a4111d83c0ffc50b6b508d7e165c12bd1ac91ccc8f6e4

General

Target
windows.bat
Size 505B
Sample260928-ppmlgsty7p
SHA256 e9649fbe4c83efe5321a4111d83c0ffc50b6b508d7e165c12bd1ac91ccc8f6e4
MD5 1620496e240bb7a1d6ba53db18539807
SHA1 a337fb67f16d07c5e4478136f6d7231c0e4ae7ba
SHA512 acbf4876c45958cd42b7fbccc1c6799468403239aa48463c56116ad8bf93981219e86f52ca72450566d86b85d04f48c2cd57752baff621a3be88c4a1fb84b4a2
TLSH
T12BF0598D242B0CF117CEC81374817CCDA18E44C946B0D5486D8361DF1D861DAAEBB7A6
MD5 SHA1 SHA512 TLSH

Score

10^/10

Malware Config

Extracted

Family

vshell

C2

ws://111.230.151.240

Attributes

port
8084
salt
qwe123qwe
type
ws
vkey
qwe123qwe

Targets

- Target
  windows.bat
- Size 505B
- SHA256 e9649fbe4c83efe5321a4111d83c0ffc50b6b508d7e165c12bd1ac91ccc8f6e4
- MD5 1620496e240bb7a1d6ba53db18539807
- SHA1 a337fb67f16d07c5e4478136f6d7231c0e4ae7ba
- SHA512 acbf4876c45958cd42b7fbccc1c6799468403239aa48463c56116ad8bf93981219e86f52ca72450566d86b85d04f48c2cd57752baff621a3be88c4a1fb84b4a2
- TLSH
  T12BF0598D242B0CF117CEC81374817CCDA18E44C946B0D5486D8361DF1D861DAAEBB7A6
- MD5 SHA1 SHA512 TLSH
Score

10^/10

backdoor discovery execution vshell rat
- Detects VSHELL Backdoor
- Family: VShell
  VShell is a cross-platform Go-based RAT and C2 framework targeting Windows and Linux.
  backdoor rat vshell
- Downloads MZ/PE file
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detects VSHELL Backdoor

Family: VShell

Downloads MZ/PE file

Executes dropped EXE

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2