vshell | db448606c3f1d6f7f096069c2f51b8e0a0e6086350448ca16e6e9bbd37466219

General

Target
windows.bat
Size 508B
Sample261104-w33cescv6x
SHA256 db448606c3f1d6f7f096069c2f51b8e0a0e6086350448ca16e6e9bbd37466219
MD5 7b792af93ce039437f894d93bf14fbfb
SHA1 5cc852df3590f635469123e8510a6f36e39a4dff
SHA512 ba429f461da1449296a1a3d281220949f5a7f412b46acecabb0a2e9b67d2001bdfd63137588b5e4f73797d0b677b03c19fa713747abd954c311a33a48e80c6fa
TLSH
T128F02ECD383518B107C5895378997C9BB41950D1C771E4485E5331F96E861A93AFBF81
MD5 SHA1 SHA512 TLSH

Score

10^/10

Malware Config

Extracted

Family

vshell

C2

111.229.153.119

Attributes

port
8086
salt
qwe123qwe
type
tcp
vkey
qwe123qwe

Targets

- Target
  windows.bat
- Size 508B
- SHA256 db448606c3f1d6f7f096069c2f51b8e0a0e6086350448ca16e6e9bbd37466219
- MD5 7b792af93ce039437f894d93bf14fbfb
- SHA1 5cc852df3590f635469123e8510a6f36e39a4dff
- SHA512 ba429f461da1449296a1a3d281220949f5a7f412b46acecabb0a2e9b67d2001bdfd63137588b5e4f73797d0b677b03c19fa713747abd954c311a33a48e80c6fa
- TLSH
  T128F02ECD383518B107C5895378997C9BB41950D1C771E4485E5331F96E861A93AFBF81
- MD5 SHA1 SHA512 TLSH
Score

10^/10

backdoor discovery execution vshell rat
- Detects VSHELL Backdoor
- Family: VShell
  VShell is a cross-platform Go-based RAT and C2 framework targeting Windows and Linux.
  backdoor rat vshell
- Downloads MZ/PE file
- Executes dropped EXE
behavioral1 behavioral2

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Network Configuration Discovery

1

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detects VSHELL Backdoor

Family: VShell

Downloads MZ/PE file

Executes dropped EXE

MITRE ATT&CK Enterprise v16

Tasks

static1

behavioral1

behavioral2