MalwareBazaar Database

This page shows some basic information the YARA rule VShell_Windows_Stager_HashedAPI including corresponding malware samples.

Database Entry

YARA Rule:VShell_Windows_Stager_HashedAPI
Create hunting rule
Author:Daydream
Description:VShell Windows stager (x86/x64, tcp and ws variants): resolves APIs by ROR-13 hash, checks %TEMP%\log_de.log, downloads a stage and XOR 0x99 decodes it in memory
Firstseen:2026-10-16 15:05:18 UTC
Lastseen:2026-10-20 00:50:14 UTC
Sightings:7

Malware Samples

The table below shows all malware samples that matching this particular YARA rule (max 1000).

Firstseen (UTC)SHA256 hashTagsSignatureReporter