vshell | aaa2d64a8585edfd48e83fcd86862b4dda94f45bd71fb2682ac295d9b797561f

General

Target
windows.bat
Size 497B
Sample260930-prphvsyapc
SHA256 aaa2d64a8585edfd48e83fcd86862b4dda94f45bd71fb2682ac295d9b797561f
MD5 a60713282d3927f7a368bb5c31232104
SHA1 673b160eff94efd09a05d8c0e4937b13703780e7
SHA512 c375f0750c420ac28b22d813af547ac0db62c700fd319cd4b8fe30f19f0abdf8ebfd14121a54f78b3e1b7385f5d6a1506bcf06a6c8d9dad565f6866347ee176f
TLSH
T195F0054F243B1D7027C2C50360523480B187C1D14571B10CEE4014D91F8916436EBB82
MD5 SHA1 SHA512 TLSH

Score

10^/10

Malware Config

Extracted

Family

vshell

C2

ws://42.194.137.92

Attributes

port
8084
salt
guanxuan
type
ws
vkey
guanxuan

Targets

- Target
  windows.bat
- Size 497B
- SHA256 aaa2d64a8585edfd48e83fcd86862b4dda94f45bd71fb2682ac295d9b797561f
- MD5 a60713282d3927f7a368bb5c31232104
- SHA1 673b160eff94efd09a05d8c0e4937b13703780e7
- SHA512 c375f0750c420ac28b22d813af547ac0db62c700fd319cd4b8fe30f19f0abdf8ebfd14121a54f78b3e1b7385f5d6a1506bcf06a6c8d9dad565f6866347ee176f
- TLSH
  T195F0054F243B1D7027C2C50360523480B187C1D14571B10CEE4014D91F8916436EBB82
- MD5 SHA1 SHA512 TLSH
Score

10^/10

backdoor discovery execution vshell rat
- Detects VSHELL Backdoor
- Family: VShell
  VShell is a cross-platform Go-based RAT and C2 framework targeting Windows and Linux.
  backdoor rat vshell
- Downloads MZ/PE file
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detects VSHELL Backdoor

Family: VShell

Downloads MZ/PE file

Executes dropped EXE

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2