vshell | 873b2c24d72282354c8624bdfe7bc75c4995a97c48a968e2d2db5626f0341993

General

Target
windows.bat
Size 500B
Sample260930-apj32axvav
SHA256 873b2c24d72282354c8624bdfe7bc75c4995a97c48a968e2d2db5626f0341993
MD5 dc56a1a3642b6c77a2a1cbefad270b68
SHA1 c41d055877695d784fd79fb57cd04c230b909f08
SHA512 7bf26645b4ac565d89a3f20d2c6b2dea8a2471e6e760d1c902283381969c9f229a4ebe7dd3402d309d73630d24f72c25c21a6524c6b1e2029193257f33e83788
TLSH
T183F09ECC101A08B9078D890374E074C2B18E40C14EA1E46C19C925E94EC9599BEFFE81
MD5 SHA1 SHA512 TLSH

Score

10^/10

Malware Config

Extracted

Family

vshell

C2

120.26.120.83

Attributes

port
8084
salt
qwe123qwe
type
ws
vkey
qwe123qwe

Targets

- Target
  windows.bat
- Size 500B
- SHA256 873b2c24d72282354c8624bdfe7bc75c4995a97c48a968e2d2db5626f0341993
- MD5 dc56a1a3642b6c77a2a1cbefad270b68
- SHA1 c41d055877695d784fd79fb57cd04c230b909f08
- SHA512 7bf26645b4ac565d89a3f20d2c6b2dea8a2471e6e760d1c902283381969c9f229a4ebe7dd3402d309d73630d24f72c25c21a6524c6b1e2029193257f33e83788
- TLSH
  T183F09ECC101A08B9078D890374E074C2B18E40C14EA1E46C19C925E94EC9599BEFFE81
- MD5 SHA1 SHA512 TLSH
Score

10^/10

backdoor discovery execution vshell rat
- Detects VSHELL Backdoor
- Family: VShell
  VShell is a cross-platform Go-based RAT and C2 framework targeting Windows and Linux.
  backdoor rat vshell
- Downloads MZ/PE file
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detects VSHELL Backdoor

Family: VShell

Downloads MZ/PE file

Executes dropped EXE

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2