sample
78dbcddcba68f5dbc77f7c4d9c1446cfeb468d898b5759fa0281490c57b5e912
A VShell sample, identified from its own bytes without running it (an embedded configuration).
78dbcddcba68f5dbc77f7c4d9c1446cfeb468d898b5759fa0281490c57b5e912
TLP:CLEAR
Sample
sha-25678dbcddcba68f5dbc77f7c4d9c1446cfeb468d898b5759fa0281490c57b5e912
familyVShell
identified byfile analysis
first seen2026-09-16 17:08 UTC
last seen2026-10-01 21:08 UTC
VShell configuration
Read from the file without running it. Endpoints are where the sample is configured to connect. An endpoint is listed on this site only if the scanner confirmed it separately. A VShell loader’s only configuration is the address and port it calls. The listener key (vkey) and the salt arrive from the listener when the loader connects, so only sandbox runs that reached a live listener show them.
endpoint · tcp119.91.41.34:8084
Every sample’s configuration, as signed-in downloads (free account): JSON · STIX · CSV.
Served by 1 address
A widely distributed file can reach unrelated hosts.
- 119.91.41.34:8084 VShell