🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 610d3e3bfef18e116a7de3aae9d8d7a941cb5664a0af78304d6fbaef62a2dc03. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


VShell


Vendor detections: 14


Intelligence 14 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 610d3e3bfef18e116a7de3aae9d8d7a941cb5664a0af78304d6fbaef62a2dc03
SHA3-384 hash: 5cd27d41eb9a7c21d6cd4bcf7a4522ad7c1d0916ad2e08b5e20f0e5cdeff7ec82adfdb4d9949b932622a1da362aeaedd
SHA1 hash: 13827a4a9c86b2158c7b9814cd3722d2264abaea
MD5 hash: 09bac7282115a0246bc92f0f5f0a20ad
humanhash: wolfram-bakerloo-zulu-item
File name:610d3e3bfef18e116a7de3aae9d8d7a941cb5664a0af78304d6fbaef62a2dc03.exe
Download: download sample
Signature VShell
Create hunting rule
File size:3'584 bytes
First seen:2026-09-18 14:15:00 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash e82dd51b077167be63c004bed23d0c1e (187 x VShell, 40 x NetWalker, 3 x Snowlight)
ssdeep 48:6Icwm0Jt2WSJ8zrD7TLjpSpc1ZsSYr8XxhxhwcRaK:4jstQSNSYp
TLSH T1A1715088F3136EF5E42C8AF94093A514D119ABB8C190BE4D5A60381D3C214BA255AF97
TrID 21.4% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
21.2% (.EXE) Win64 Executable (generic) (6522/11/2)
16.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
14.6% (.EXE) Win32 Executable (generic) (4504/4/1)
6.6% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter whack_sh
Tags:exe vshell

Intelligence

File Origin
# of uploads :
1
# of downloads :
121
Origin country :
US US
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
Malicious activity
Analysis date:
2026-09-18 14:19:16 UTC
Tags:
payload vshell rat
Link:
https://app.any.run/tasks/8b859fee-3413-45cc-8047-c693b9c27270

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/86608/
Detection(s):
Win.Trojan.Mikey-10038331-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Connection attempt
Sending a custom TCP request
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive microsoft_visual_cc packed
Link:
https://www.filescan.io/uploads/6aad47802988d53e7e410863/reports/c80a7a01-7d7e-4680-981b-25fa9e1c21c7/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/610d3e3bfef18e116a7de3aae9d8d7a941cb5664a0af78304d6fbaef62a2dc03
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-09-18T09:36:00Z UTC
Last seen:
2026-09-18T11:47:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/610d3e3bfef18e116a7de3aae9d8d7a941cb5664a0af78304d6fbaef62a2dc03/results?tab=lookup
Malware family:
Knight
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/862c1ea6-3c58-48c5-b248-dc64113a4970
Result
Threat name:
VShell
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/1974784
Signature
Antivirus / Scanner detection for submitted sample
C2 URLs / IPs found in malware configuration
Detected unpacking (creates a PE file in dynamic memory)
Found malware configuration
Multi AV Scanner detection for submitted file
Unusual module load detection (module proxying)
Yara detected VShell
Behaviour
Behavior Graph:
Download SVG
Score:
85%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/610d3e3bfef18e116a7de3aae9d8d7a941cb5664a0af78304d6fbaef62a2dc03
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/09bac7282115a0246bc92f0f5f0a20ad
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/610d3e3bfef18e116a7de3aae9d8d7a941cb5664a0af78304d6fbaef62a2dc03/
Threat name:
Win32.Trojan.Mikey
Create hunting rule
Status:
Malicious
First seen:
2026-09-18 14:15:25 UTC
File Type:
PE (Exe)
AV detection:
29 of 38 (76.32%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=megt4o766ghbc2t54ovotwgxvfa4wvteucxxqmcnn65o6yvc3qbq._file
Verdict:
malicious
Label(s):
SNOWLIGHT
Create hunting rule
Link:
https://reports.threatray.com/66a2836a-e417-4b98-85de-81326ea9dc7c
Result
Malware family:
vshell
Create hunting rule
Score:
  10/10
Tags:
family:vshell backdoor discovery rat
Link:
https://tria.ge/reports/260918-rksm2sxtcx/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
System Location Discovery: System Language Discovery
Detects VSHELL Backdoor
Family: VShell
Unpacked files
SH256 hash:
610d3e3bfef18e116a7de3aae9d8d7a941cb5664a0af78304d6fbaef62a2dc03
MD5 hash:
09bac7282115a0246bc92f0f5f0a20ad
SHA1 hash:
13827a4a9c86b2158c7b9814cd3722d2264abaea
Link:
https://www.unpac.me/results/196ad68a-26dc-45c7-a7d4-d6d19b7999c5/
Malware family:
VShell
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/610d3e3bfef1/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Legit
Score:
0.14
Link:
https://yomi.yoroi.company/submissions/610d3e3bfef18e116a7de3aae9d8d7a941cb5664a0af78304d6fbaef62a2dc03

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

VShell

Executable exe 610d3e3bfef18e116a7de3aae9d8d7a941cb5664a0af78304d6fbaef62a2dc03

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/86608/

Comments