Threat Actor Characterization
VShell
ID: e2e1fcdd390249b8977a82bb5c948b8684635Related profiles
| ID | Threat | Origin | Type | Categories | |
|---|---|---|---|---|---|
|
ad0437fa157c5a6a576424134e671cae32408 | SparkRAT | Unknown | related | Crimeware |
Related files
| Filename | Size | SHA-1 | OS target | Identified |
|---|---|---|---|---|
| memfd.elf | 7.72 MB | 978c8d81************************ea6013bd | Malware | |
| vshell.elf | 7.71 MB | aa9385c8************************e124c7f8 | Malware | |
| dnsloger | 9.62 KB | 0fbac5c9************************93b14e7d | Malware |
Actor Network Graph
Open Network GraphMITRE ATT&CK®
VShell is a malware/tooling cluster referenced in public reporting as both a post-exploitation remote control framework and a Linux-focused fileless backdoor chain. It is primarily relevant as an intrusion enabler (access, control, tunneling) observed in China-nexus activity and exploitation-driven compromises.
| Technique | Technique name | Tactics | Evidence |
|---|---|---|---|
| T1190 | Exploit Public-Facing Application | TA0001 |
|
| T1505.003 | Web Shell | TA0003 |
|
| T1566.001 | Spearphishing Attachment | TA0001 |
|
| T1059.004 | Unix Shell | TA0002 |
|
| T1027 | Obfuscated Files or Information | TA0005 |
|
| T1036 | Masquerading | TA0005 |
|
| T1105 | Ingress Tool Transfer | TA0011 |
|
| T1071.001 | Web Protocols | TA0011 |
|
| T1090 | Proxy | TA0011 |
|
| T1583.001 | Domains | TA0042 |
|
VShell - Malware/Tooling (TLP:WHITE)
Executive Summary
VShell is referenced in public reporting as (at least) two overlapping things: (1) a China-nexus post-exploitation framework/remote control tooling referred to as “VShell”, and (2) a Go-based Linux backdoor delivered via a filename-weaponized RAR infection chain (often discussed alongside SNOWLIGHT). Public sources also use “vshell” loosely when talking about generic web shells, which creates attribution and detection confusion.
This dossier treats VShell as a malware/tooling cluster with two sub-clusters: VShell (post-exploitation framework) and VShell (Linux fileless backdoor). Where a claim is tied to a specific reporting thread, it is explicitly scoped and cross-referenced by OSINT IDs in the OSINT Library.