🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 53cc143c730ee92dba972b6c414f4499996bb6864ee300ec0da657b654d63df7. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


VShell


Vendor detections: 12


Intelligence 12 IOCs 1 YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 53cc143c730ee92dba972b6c414f4499996bb6864ee300ec0da657b654d63df7
SHA3-384 hash: 39c757bcb74944715bf16bd616d15dafe25253abca107a6a3e0817d263e8717e1d42aeb0f37ce394ae443b5b4832acb4
SHA1 hash: 5a26b4a2c77077e9c194b9ff9e0e6f0193036349
MD5 hash: 54f9c30fd7d545c85a0b1bef737b0e4d
humanhash: autumn-river-march-alanine
File name:53cc143c730ee92dba972b6c414f4499996bb6864ee300ec0da657b654d63df7.exe
Download: download sample
Signature VShell
Create hunting rule
File size:3'584 bytes
First seen:2026-10-01 02:47:47 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash e82dd51b077167be63c004bed23d0c1e (446 x VShell, 40 x NetWalker, 2 x GuLoader)
ssdeep 48:6Icwm02/Mt2WRhJ8zrD7TLjpSpc1ZsSYr8XxhxhwcRaK:4j1Ut1HSNSYp
TLSH T1E4715098F3176AF5E43C86F84093A624D519ABBCC250AE4D5A60281D3C610BA255AF96
TrID 21.4% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
21.2% (.EXE) Win64 Executable (generic) (6522/11/2)
16.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
14.6% (.EXE) Win32 Executable (generic) (4504/4/1)
6.6% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter whack_sh
Tags:exe vshell

Indicators Of Compromise (IOCs)

Below is a list of indicators of compromise (IOCs) associated with this malware samples.

IOCThreatFox Reference
116.205.137.86:3389 https://threatfox.abuse.ch/ioc/1894129/

Intelligence

File Origin
# of uploads :
1
# of downloads :
200
Origin country :
US US
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
No threats detected
Analysis date:
2026-10-01 02:56:53 UTC
Tags:
n/a
Link:
https://app.any.run/tasks/f269e03e-8dbb-4377-9808-9edae702bd4c

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/89971/
Detection(s):
Win.Trojan.Mikey-10038331-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Connection attempt
Sending a custom TCP request
Gathering data
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/53cc143c730ee92dba972b6c414f4499996bb6864ee300ec0da657b654d63df7
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-09-23T11:23:00Z UTC
Last seen:
2026-10-02T18:31:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/53cc143c730ee92dba972b6c414f4499996bb6864ee300ec0da657b654d63df7/results?tab=lookup
Malware family:
Knight
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/20b86360-ee1b-4348-833f-4486bb00c02b
Result
Threat name:
SNOWLIGHT, VShell
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
92 / 100
Link:
https://www.joesandbox.com/analysis/1980349
Signature
Antivirus / Scanner detection for submitted sample
C2 URLs / IPs found in malware configuration
Found malware configuration
Multi AV Scanner detection for submitted file
Sigma detected: Outbound RDP Connections Over Non-Standard Tools
Unusual module load detection (module proxying)
Yara detected SNOWLIGHT
Yara detected VShell
Behaviour
Behavior Graph:
Download SVG
Score:
85%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/53cc143c730ee92dba972b6c414f4499996bb6864ee300ec0da657b654d63df7
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/54f9c30fd7d545c85a0b1bef737b0e4d
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/53cc143c730ee92dba972b6c414f4499996bb6864ee300ec0da657b654d63df7/
Threat name:
Win32.Trojan.Mikey
Create hunting rule
Status:
Malicious
First seen:
2026-09-23 16:46:49 UTC
File Type:
PE (Exe)
AV detection:
28 of 36 (77.78%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=kpgbipdtb3us3ouxfnwect2etgmwxnugj3rqb3anuzl3mvgwhx3q._file
Verdict:
malicious
Label(s):
SNOWLIGHT
Create hunting rule
Link:
https://reports.threatray.com/59fdecaf-70b2-4770-ba84-a50782c41c77
Result
Malware family:
vshell
Create hunting rule
Score:
  10/10
Tags:
family:vshell backdoor discovery rat
Link:
https://tria.ge/reports/261001-dakykagc85/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Reads the TCP/IP host and domain name from the registry
System Location Discovery: System Language Discovery
Detects VSHELL Backdoor
Family: VShell
Unpacked files
SH256 hash:
53cc143c730ee92dba972b6c414f4499996bb6864ee300ec0da657b654d63df7
MD5 hash:
54f9c30fd7d545c85a0b1bef737b0e4d
SHA1 hash:
5a26b4a2c77077e9c194b9ff9e0e6f0193036349
Link:
https://www.unpac.me/results/855153bb-91b3-47bd-82fe-4f10a7c406c5/
Malware family:
VShell
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/53cc143c730e/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Suspicious File
Score:
0.34
Link:
https://yomi.yoroi.company/submissions/53cc143c730ee92dba972b6c414f4499996bb6864ee300ec0da657b654d63df7

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

VShell

Executable exe 53cc143c730ee92dba972b6c414f4499996bb6864ee300ec0da657b654d63df7

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/89971/

Comments