vshell | fb9791b689dac8a1b9e63722f78266c90f1188aebb02f8eea33f60c8c8ab86c3

General

Target
windows.bat
Size 493B
Sample261001-phlevabe95
SHA256 fb9791b689dac8a1b9e63722f78266c90f1188aebb02f8eea33f60c8c8ab86c3
MD5 d179c4ebdcaa87a6823cccab2025d686
SHA1 55a749cf37a1cb22c80215d1a9f6fa0f037de3f7
SHA512 1fe58a12cda0e888ba9fa168c0e02605f3802a969dac44b0783347ad08f2edf42a77203233a129b6ca8d2bd771b9d932dda404411e7700b9865e54e1d0858fb5
TLSH
T17DF059DC00970D740F82C85334906581B18B44C0CAF1978CA9D031E96E893D929AB7C3
MD5 SHA1 SHA512 TLSH

Score

10^/10

Malware Config

Extracted

Family

vshell

C2

ws://47.94.175.23

Attributes

port
8084
salt
Pjh070713!
type
ws
vkey
Pjh070713!

Targets

- Target
  windows.bat
- Size 493B
- SHA256 fb9791b689dac8a1b9e63722f78266c90f1188aebb02f8eea33f60c8c8ab86c3
- MD5 d179c4ebdcaa87a6823cccab2025d686
- SHA1 55a749cf37a1cb22c80215d1a9f6fa0f037de3f7
- SHA512 1fe58a12cda0e888ba9fa168c0e02605f3802a969dac44b0783347ad08f2edf42a77203233a129b6ca8d2bd771b9d932dda404411e7700b9865e54e1d0858fb5
- TLSH
  T17DF059DC00970D740F82C85334906581B18B44C0CAF1978CA9D031E96E893D929AB7C3
- MD5 SHA1 SHA512 TLSH
Score

10^/10

backdoor discovery execution vshell rat
- Detects VSHELL Backdoor
- Family: VShell
  VShell is a cross-platform Go-based RAT and C2 framework targeting Windows and Linux.
  backdoor rat vshell
- Downloads MZ/PE file
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detects VSHELL Backdoor

Family: VShell

Downloads MZ/PE file

Executes dropped EXE

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2