s2
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

TF-1932529 high

📛 Threat Title

VShell: SHA256 hash of a malware sample (payload) 4ac8d92803e43ef96a610e1c65b341d0a53e54b0e13294b957719a7671adb572

Category: VShell Published: Source updated: First seen: Last updated: Source: ThreatFox IOCs

Description

Indicator that identifies a malware sample (payload). IOC type: SHA256 hash of a malware sample (payload). Attributed malware: VShell. Confidence: 95. First seen: 2026-09-25 00:42:02 UTC. Reporter: whack_sh. Tags: exe, Vshell.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

hash_sha256 4ac8d92803e43ef96a610e1c65b341d0a53e54b0e13294b957719a7671adb572 VT 57 / 74

IOC database

Type
hash_sha256
Value
4ac8d92803e43ef96a610e1c65b341d0a53e54b0e13294b957719a7671adb572
First seen
Last seen
Attached to this threat
Appears in
2 threats
Description
VShell

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 57 of 74 VirusTotal vendors

VendorVerdictDetection
AhnLab-V3 malicious Trojan/Win.Generic.C5508256
Alibaba malicious Trojan:Win32/Mikey.3da918f4
alibabacloud malicious Backdoor:Win/shellcode.api(dyn)
ALYac malicious Gen:Variant.Application.Jaik.45622
Antiy-AVL malicious Trojan/Win32.Mikey
APEX malicious Malicious
Arcabit malicious Trojan.Application.Jaik.DB236
Avast malicious Win32:MalwareX-gen [Trj]
AVG malicious Win32:MalwareX-gen [Trj]
Avira malicious TR/W32.MalwareX
BitDefender malicious Gen:Variant.Application.Jaik.45622
Bkav malicious W32.Malware.BD02346A
CAT-QuickHeal malicious Trojan.Mikey
ClamAV malicious Win.Trojan.Mikey-10038331-0
CrowdStrike malicious win/malicious_confidence_100% (W)
CTX malicious exe.trojan.mikey
Cylance malicious Unsafe
Cynet malicious Malicious (score: 100)
DeepInstinct malicious MALICIOUS
DrWeb malicious Trojan.Siggen33.25221
Elastic malicious malicious (high confidence)
Emsisoft malicious Gen:Variant.Application.Jaik.45622 (B)
ESET-NOD32 malicious Win64/Rozena.ZA trojan
F-Secure malicious Trojan.TR/W32.MalwareX
Fortinet malicious W32/Rozena.ZA!tr
GData malicious Gen:Variant.Application.Jaik.45622
Google malicious Detected
Gridinsoft malicious Trojan.Win32.Downloader.sa
huorong malicious Trojan/Fake.ao
Ikarus malicious Trojan-Downloader.Win64.Small
Jiangmin malicious Trojan.Generic.hscze
K7AntiVirus malicious Trojan ( 001203481 )
K7GW malicious Trojan ( 001203481 )
Kaspersky malicious HEUR:Trojan.Win32.Generic
Kingsoft malicious malware.kb.a.916
Lionic malicious Trojan.Win32.Mikey.4!c
McAfeeD malicious ti!4AC8D92803E4
Microsoft malicious Trojan:Win32/Mikey.HNC!MTB
MicroWorld-eScan malicious Gen:Variant.Application.Jaik.45622
NANO-Antivirus malicious Virus.Win32.Gen.ccmw
Paloalto malicious generic.ml
Panda malicious Trj/CI.A
Rising malicious Backdoor.VShell!1.13126 (CLASSIC)
Sangfor malicious Trojan.Win32.Rozena.Vis4
SentinelOne malicious Static AI - Suspicious PE
Sophos malicious Troj/Loader-IY
SUPERAntiSpyware malicious Trojan.Agent/Gen-Mikey
Symantec malicious ML.Attribute.HighConfidence
Tencent malicious Win32.Trojan.Generic.Jqil
TrellixENS malicious Artemis!31C5770C6AF3
TrendMicro-HouseCall malicious TROJ_GEN.R002C0DIJ26
Varist malicious W32/Rozena.JO.gen!Eldorado
VBA32 malicious Trojan.Mikey
VIPRE malicious Gen:Variant.Application.Jaik.45622
VirIT malicious Trojan.Win32.GenHeur.C
Webroot malicious W32.Trojan.Gen
ZoneAlarm malicious Troj/Loader-IY

Details From VirusTotal

Basic Properties
MD531c5770c6af310d9b17fea3b0a3a6d21
SHA-11418e131318d04f7305b6f2c4aaf18db94b576e7
SHA-2564ac8d92803e43ef96a610e1c65b341d0a53e54b0e13294b957719a7671adb572
VHash03303665151bz1!z
SSDEEP48:6Icwm07z8t2WSJ8zrD7TLjpSpc1ZsSYr8XxhxhwcRaK:4jo8tQSNSYp
TLSHT119715098F3136AF1E42C46F84093A654D1599BB8C250AE4D5E60281D3C210BA265AF96
File typeWin32 EXE
File type tagpeexe
File extensionexe
MagicPE32 executable (GUI) Intel 80386, for MS Windows
File size3.5 KB
History
Creation date2023-10-26 14:42 UTC
First seen on VirusTotal2026-09-16 18:11 UTC
Last submission2026-09-16 18:11 UTC
Last analysis2026-09-20 02:06 UTC
Last modified on VirusTotal2026-09-24 19:05 UTC
Known Names
  • uuz1k8dai.exe
  • windows_i386.exe

References (2)

  • Malpedia profile ThreatFox IOCs
  • ThreatFox IOC page ThreatFox IOCs

    Indicator that identifies a malware sample (payload). IOC type: SHA256 hash of a malware sample (payload). Attributed malware: VShell. Confidence: 95. First seen: 2026-09-25 00:42:02 UTC. Reporter: whack_sh. Tags: exe, Vshell.

Remediations (10)

  • MalwareBazaar | SHA256 ...
    web:bazaar.abuse.ch

    You are currently viewing the MalwareBazaar entry for SHA256 3e7d4140d6032515c6d19b25ee836c522519935db8b54d350020f94f744c5281. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

  • MalwareBazaar | SHA256 ...
    web:bazaar.abuse.ch

    Information on VShell malware sample ( SHA256 d4a1d31071219e052098223e88b0bc28bb78cc47fb0b6aa8cddf4ceff36ef556) YARA Signatures MalwareBazaar uses YARA rules from ...

  • PDF Decoding VShell - blog.nviso.eu
    web:blog.nviso.eu

    VShell has evolved into an offensive backdoor, offering modular design, encrypted communications, and cross-platform support, making it a preferred tool for long-term persistence and covert cyber espionage. This report provides defenders with actionable insights to detect and interrupt VShell operations. We share global infrastructure tracking techniques, tools to decrypt VShell communications ...

  • VShell Linux Backdoor - The PolySwarm
    web:blog.polyswarm.io

    VShell is a sophisticated Go-based backdoor targeting Linux systems through a novel infection chain that weaponizes filenames in RAR archives. This malware , linked to Chinese APT groups, exploits common shell scripting practices to execute malicious Bash payloads , delivering a stealthy, memory-resident backdoor capable of remote control, file ...

  • VShell — Malware Profile & Detection | BotEraser
    web:boteraser.com

    File-based IOCs include SHA-256 hashes for loader DLLs such as vmtools.dll (e.g., 2a8c6f1b9e3d7f4a0c5b2e8d1f6a3b9c7d0e4f5a6b7c8d9e0f1a2b3c4d5e6f). Behavioral indicators in MITRE ATT&CK (T1055.012—Process Hollowing, T1543.003—Windows Service) show creation of services named VShellHelper or VMwareToolsService pointing to non-standard paths.

  • Hash Reputation Checker — MD5/SHA-256 Malware Lookup
    web:cipherssecurity.com

    Check MD5, SHA-1, or SHA-256 file hashes against MalwareBazaar and VirusTotal feeds. Drop a file — hashing happens in your browser, never uploaded.

  • Malware Hashes - File Hash Intelligence | isMalicious
    web:ismalicious.com

    Database of known malware file hashes. MD5, SHA1, and SHA256 hashes with malware family classification. Updated daily from sandbox analysis and vendor feeds.

  • VShell malware — IOCs & CVEs | isMalicious
    web:ismalicious.com

    1,755 indicators of compromise attributed to the VShell malware family — domains, IPs, URLs and file hashes, from abuse.ch feeds.

  • UNC5174's evolution in China's ongoing cyber warfare: From SNOWLIGHT to ...
    web:www.sysdig.com

    The SNOWLIGHT malware acts as a dropper for a fileless payload that resides solely in memory, called VShell . VShell is a Remote Access Trojan (RAT) popular among Chinese-speaking cybercriminals in several forums, and its main developer is also a Chinese speaker.

  • The Silent, Fileless Threat of VShell - trellix.com
    web:www.trellix.com

    Final payload : VShell malware VShell malware is a Go-based backdoor used primarily by Chinese APT groups for remote access, file operations, and post-exploitation control on infected systems especially Linux servers.

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.