vshell | c4e4749d771622ba86c9770ae02b5703220203025cdfadaef13454b48e80a98d

General

Target
windows.bat
Size 500B
Sample260930-apdk9axv6j
SHA256 c4e4749d771622ba86c9770ae02b5703220203025cdfadaef13454b48e80a98d
MD5 54fc2cf81abf4dce8fd823afc87bc650
SHA1 661e2a2a06517179da4358c2951de9769afd8f1b
SHA512 a1eadbfe32d663036818ffa5dcbad508635e1be22c816968ec442388d680970b86457dd99cfd23328fce969c1fd8540d81a5769e7e817e1728fd0b43cbe21c7b
TLSH
T18CF09E8C141A08B50789C90374E074C2B14E40C14EA1E46D19C825DA4EC9599BDFFE81
MD5 SHA1 SHA512 TLSH

Score

10^/10

Malware Config

Extracted

Family

vshell

C2

120.26.120.83

Attributes

port
8084
salt
qwe123qwe
type
ws
vkey
qwe123qwe

Targets

- Target
  windows.bat
- Size 500B
- SHA256 c4e4749d771622ba86c9770ae02b5703220203025cdfadaef13454b48e80a98d
- MD5 54fc2cf81abf4dce8fd823afc87bc650
- SHA1 661e2a2a06517179da4358c2951de9769afd8f1b
- SHA512 a1eadbfe32d663036818ffa5dcbad508635e1be22c816968ec442388d680970b86457dd99cfd23328fce969c1fd8540d81a5769e7e817e1728fd0b43cbe21c7b
- TLSH
  T18CF09E8C141A08B50789C90374E074C2B14E40C14EA1E46D19C825DA4EC9599BDFFE81
- MD5 SHA1 SHA512 TLSH
Score

10^/10

backdoor discovery execution vshell rat
- Detects VSHELL Backdoor
- Family: VShell
  VShell is a cross-platform Go-based RAT and C2 framework targeting Windows and Linux.
  backdoor rat vshell
- Downloads MZ/PE file
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detects VSHELL Backdoor

Family: VShell

Downloads MZ/PE file

Executes dropped EXE

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2