🤲🏼 NEW | abuse.ch Community Hub! Earn recognition 🏅 for the malware intelligence you share, climb the leaderboards 📈, and connect with like-minded contributors who share your hunting focus 🤝. Ready to unlock your profile? Go to the Community Hub →

MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 77a90a2dd2aeef925b0198b39a788c9ff5183044bdfa398c75889c74750fe407. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


VShell


Vendor detections: 14


Intelligence 14 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 77a90a2dd2aeef925b0198b39a788c9ff5183044bdfa398c75889c74750fe407
SHA3-384 hash: a07b8ab8a58461da1914d81aab78d4246e8550d5c672ce1313aefc7f8bb6bb027f097f121a34b524356240009f7405df
SHA1 hash: 09f88fc4bc1c9d6a1a6d1f0986aa0363280cca0c
MD5 hash: 667f059cf22e7a4f6c26ba015dfe0229
humanhash: wisconsin-magnesium-johnny-mirror
File name:77a90a2dd2aeef925b0198b39a788c9ff5183044bdfa398c75889c74750fe407.exe
Download: download sample
Signature VShell
Create hunting rule
File size:3'584 bytes
First seen:2026-09-18 14:50:53 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash e82dd51b077167be63c004bed23d0c1e (212 x VShell, 40 x NetWalker, 2 x GuLoader)
ssdeep 48:6Icwm02t2WSJ8zrD7TLjpSpc1ZsSYr8XxhxhwcRaK:4jTtQSNSYp
TLSH T16B716188F3276AF5E42C47F900D3A524C059ABB8C250BF4D5EA0381D3C210BA269AF96
TrID 21.4% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
21.2% (.EXE) Win64 Executable (generic) (6522/11/2)
16.3% (.EXE) Win16 NE executable (generic) (5038/12/1)
14.6% (.EXE) Win32 Executable (generic) (4504/4/1)
6.6% (.ICL) Windows Icons Library (generic) (2059/9)
Magika pebin
Reporter whack_sh
Tags:exe vshell

Intelligence

File Origin
# of uploads :
1
# of downloads :
147
Origin country :
US US
Vendor Threat Intelligence
No detections
Malware family:
n/a
ID:
1
File name:
exe
Verdict:
No threats detected
Analysis date:
2026-09-18 15:48:24 UTC
Tags:
payload golang
Link:
https://app.any.run/tasks/24806443-f6ce-4354-9cda-f6ac29cec612

Note:
ANY.RUN is an interactive sandbox that analyzes all user actions rather than an uploaded sample
Detection:
n/a
Link:
https://www.capesandbox.com/analysis/86658/
Detection(s):
Win.Trojan.Mikey-10038331-0
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Connection attempt
Sending a custom TCP request
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
evasive microsoft_visual_cc packed
Link:
https://www.filescan.io/uploads/6aad4fe4176c7303d3f32bdd/reports/7d2052fb-8603-4d7a-aba4-aee40f5e1d8b/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/77a90a2dd2aeef925b0198b39a788c9ff5183044bdfa398c75889c74750fe407
Verdict:
Malicious
File Type:
exe x32
First seen:
2026-09-10T00:59:00Z UTC
Last seen:
2026-09-19T22:27:00Z UTC
Hits:
~10
Link:
https://opentip.kaspersky.com/77a90a2dd2aeef925b0198b39a788c9ff5183044bdfa398c75889c74750fe407/results?tab=lookup
Malware family:
Knight
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/baf6d1b7-8cd4-46d8-81dd-089c620d705d
Result
Threat name:
VShell
Create hunting rule
Detection:
malicious
Classification:
troj.evad
Score:
88 / 100
Link:
https://www.joesandbox.com/analysis/1974837
Signature
Antivirus / Scanner detection for submitted sample
C2 URLs / IPs found in malware configuration
Detected unpacking (creates a PE file in dynamic memory)
Found malware configuration
Multi AV Scanner detection for submitted file
Unusual module load detection (module proxying)
Yara detected VShell
Behaviour
Behavior Graph:
Download SVG
Score:
85%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/77a90a2dd2aeef925b0198b39a788c9ff5183044bdfa398c75889c74750fe407
Verdict:
inconclusive
YARA:
4 match(es)
Tags:
Executable PDB Path PE (Portable Executable) PE File Layout Win 32 Exe x86
Link:
https://app.malva.re/file/667f059cf22e7a4f6c26ba015dfe0229
Detection:
n/a
Link:
https://mwdb.cert.pl/sample/77a90a2dd2aeef925b0198b39a788c9ff5183044bdfa398c75889c74750fe407/
Threat name:
Win32.Trojan.Mikey
Create hunting rule
Status:
Malicious
First seen:
2026-09-10 04:12:25 UTC
File Type:
PE (Exe)
AV detection:
30 of 38 (78.95%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=o6uqulosv3xzewybtczzu6emt72rqmcexx5dtddvrcohi5ip4qdq._file
Verdict:
malicious
Label(s):
SNOWLIGHT
Create hunting rule
Link:
https://reports.threatray.com/0e064b6c-c4c6-4287-a2c9-31337b0b67d4
Result
Malware family:
vshell
Create hunting rule
Score:
  10/10
Tags:
family:vshell backdoor discovery rat
Link:
https://tria.ge/reports/260918-r8agdagc97/
Behaviour
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
System Location Discovery: System Language Discovery
Detects VSHELL Backdoor
Family: VShell
Unpacked files
SH256 hash:
77a90a2dd2aeef925b0198b39a788c9ff5183044bdfa398c75889c74750fe407
MD5 hash:
667f059cf22e7a4f6c26ba015dfe0229
SHA1 hash:
09f88fc4bc1c9d6a1a6d1f0986aa0363280cca0c
Link:
https://www.unpac.me/results/ccf812c8-99df-4715-9127-17ef805daeee/
Malware family:
VShell
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/77a90a2dd2ae/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/77a90a2dd2aeef925b0198b39a788c9ff5183044bdfa398c75889c74750fe407

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

VShell

Executable exe 77a90a2dd2aeef925b0198b39a788c9ff5183044bdfa398c75889c74750fe407

(this sample)

  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/86658/

Comments