vshell | 4cb75775ee2f88f315353e180dd516551d0dd1fb3e41a6b6a2e93a988ddfc9ca

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/09/2026, 02:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4cb75775ee2f88f315353e180dd516551d0dd1fb3e41a6b6a2e93a988ddfc9ca.exe
Size 3KB
Sample260930-c9c7bswyes
SHA256 4cb75775ee2f88f315353e180dd516551d0dd1fb3e41a6b6a2e93a988ddfc9ca
MD5 a7ebf8722a0cda79902f646df1620814
SHA1 08036157308509374a600aa50e996bbb359ae3cf
SHA512 0c92167f78e328f15b1cc19c528e70619e4f825764cc8d43d8feb8744b18b3223475bed12a396e197e99e9ee02aefdf953f63e0bb1ff6b32976524fc9ce002c7
TLSH
T11C71D641605416F2E94DE37F8487B895FD5FB24CA2D80B0F0798981A2F710BBB1DD613
MD5 SHA1 SHA512 TLSH

Score

10^/10

backdoor discovery vshell rat

Malware Config

Extracted

Family

vshell

47.118.26.230

Attributes

port
8888
salt
qwe123qwe
type
tcp
vkey
qwe123qwe

Signatures

Family: VShell
VShell is a cross-platform Go-based RAT and C2 framework targeting Windows and Linux.
backdoor rat vshell

Detects VSHELL Backdoor 1 IoCs

resource	yara_rule
behavioral2/memory/2620-0-0x0000000067700000-0x0000000067ED4000-memory.dmp	family_vshell

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	4cb75775ee2f88f315353e180dd516551d0dd1fb3e41a6b6a2e93a988ddfc9ca.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	4cb75775ee2f88f315353e180dd516551d0dd1fb3e41a6b6a2e93a988ddfc9ca.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2620	4cb75775ee2f88f315353e180dd516551d0dd1fb3e41a6b6a2e93a988ddfc9ca.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2620	4cb75775ee2f88f315353e180dd516551d0dd1fb3e41a6b6a2e93a988ddfc9ca.exe

C:\Users\Admin\AppData\Local\Temp\4cb75775ee2f88f315353e180dd516551d0dd1fb3e41a6b6a2e93a988ddfc9ca.exe
"C:\Users\Admin\AppData\Local\Temp\4cb75775ee2f88f315353e180dd516551d0dd1fb3e41a6b6a2e93a988ddfc9ca.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2620

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2620-0-0x0000000067700000-0x0000000067ED4000-memory.dmp

Download

memory/2620-3-0x0000018CA31E0000-0x0000018CA4E7D000-memory.dmp

Download

memory/2620-11-0x0000018CA31E0000-0x0000018CA4E7D000-memory.dmp

Download