s1
--:--:--UTC

Searching APEX

Starting…

  1. ○ Searching Threats, IOCs & Threat Intelligence locally
  2. ○ Querying external providers
  3. ○ Asking AI Forensic Validator
  4. ○ Creating new entry from validated hit

0s elapsed

TF-2013307 high

📛 Threat Title

VShell: SHA1 hash of a malware sample (payload) 7ace12a4f2bc0c2206317b45d35455aac68cc82c

Category: VShell Published: Source updated: First seen: Last updated: Source: Threatfox IOCs/Threats

Description

Indicator that identifies a malware sample (payload). IOC type: SHA1 hash of a malware sample (payload). Attributed malware: VShell. Confidence: 95. First seen: 2026-11-03 16:42:38 UTC. Reporter: Grim.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

hash_sha1 7ace12a4f2bc0c2206317b45d35455aac68cc82c VT 50 / 75

IOC database

Type
hash_sha1
Value
7ace12a4f2bc0c2206317b45d35455aac68cc82c
First seen
Last seen
Attached to this threat
Appears in
2 threats
Description
SHA1 hash of a malware sample (payload) attributed to VShell

Open the full IOC page →

Threat Hunt — feed corroboration

Not present in any configured threat-intel feed.

Flagged by 50 of 75 VirusTotal vendors

VendorVerdictDetection
AhnLab-V3 malicious Trojan/Win.Generic.C5508256
alibabacloud malicious Backdoor:Win/shellcode.api(dyn)
ALYac malicious Gen:Variant.Application.Fragtor.40843
Antiy-AVL malicious Trojan/Generic.ASMalwRH.28592
APEX malicious Malicious
Arcabit malicious Trojan.Application.Fragtor.D9F8B
Avast malicious Win32:MalwareX-gen [Trj]
AVG malicious Win32:MalwareX-gen [Trj]
Avira malicious TR/W32.MalwareX
BitDefender malicious Gen:Variant.Application.Fragtor.40843
Bkav malicious W32.Malware.24FFDBFF
CrowdStrike malicious win/malicious_confidence_100% (W)
CTX malicious exe.unknown.fragtor
Cylance malicious Unsafe
Cynet malicious Malicious (score: 100)
DeepInstinct malicious MALICIOUS
DrWeb malicious BackDoor.Siggen2.5324
Elastic malicious malicious (high confidence)
Emsisoft malicious Gen:Variant.Application.Fragtor.40843 (B)
ESET-NOD32 malicious Win64/Rozena.ZA trojan
F-Secure malicious Trojan.TR/W32.MalwareX
Fortinet malicious W32/Rozena.ZA!tr
GData malicious Gen:Variant.Application.Fragtor.40843
Google malicious Detected
huorong malicious TrojanDownloader/Agent.bri
Ikarus malicious Trojan-Downloader.Win64.Small
K7AntiVirus malicious Trojan ( 001203481 )
K7GW malicious Trojan ( 001203481 )
Kaspersky malicious HEUR:Trojan.Win32.Generic
Kingsoft malicious malware.kb.a.933
MaxSecure malicious Trojan.Malware.8147765.susgen
McAfeeD malicious ti!80321ED0B0CD
Microsoft malicious Trojan:Win32/Mikey.HNC!MTB
MicroWorld-eScan malicious Gen:Variant.Application.Fragtor.40843
NANO-Antivirus malicious Virus.Win32.Gen.ccmw
Rising malicious Malware.Undefined!8.C (TFE:3:Va1tsgOetEG)
SentinelOne malicious Static AI - Suspicious PE
Skyhigh malicious VShell-JCAD!5865CD8778D0
Sophos malicious Troj/Loader-IY
SUPERAntiSpyware malicious Trojan.Agent/Gen-Mikey
Symantec malicious ML.Attribute.HighConfidence
Tencent malicious Trojan.Win64.Rozena.16006312
Trapmine malicious suspicious.low.ml.score
TrellixENS malicious VShell-JCAD!5865CD8778D0
Varist malicious W32/Rozena.JO.gen!Eldorado
VBA32 malicious BScope.Trojan.Wacatac
VIPRE malicious Gen:Variant.Application.Fragtor.40843
VirIT malicious Trojan.Win32.Genus.ZQO
Webroot malicious Win.Trojan.Gen
ZoneAlarm malicious Troj/Loader-IY

Details From VirusTotal

Basic Properties
MD55865cd8778d04d7e18e829fda320d7c5
SHA-17ace12a4f2bc0c2206317b45d35455aac68cc82c
SHA-25680321ed0b0cd883510648fd868f04aa738b4abf3144f57299fb9f498e716a6e9
VHash04303655151bz1!z
SSDEEP48:6I7lwe7gi08SwJdSR1Ig9TPe1YpV1ZsSZIXxhxhwcRaK:Pl1l096q1Ig9T2Enwp
TLSHT1A391A5C5F757E6B2EC1C07F500A3B9A4C4682E14827C9B564FA16F1C3C111AA3C7EA56
File typeWin32 EXE
File type tagpeexe
File extensionexe
MagicPE32 executable (GUI) Intel 80386, for MS Windows
File size4.5 KB
History
Creation date2023-10-26 14:20 UTC
First seen on VirusTotal2026-11-02 23:10 UTC
Last submission2026-11-02 23:10 UTC
Last analysis2026-11-02 23:10 UTC
Last modified on VirusTotal2026-11-03 02:28 UTC
Known Names
  • on55unuq.exe
  • windows_i386.exe

References (2)

  • Malpedia profile Threatfox IOCs/Threats
  • ThreatFox IOC page Threatfox IOCs/Threats

    Indicator that identifies a malware sample (payload). IOC type: SHA1 hash of a malware sample (payload). Attributed malware: VShell. Confidence: 95. First seen: 2026-11-03 16:42:38 UTC. Reporter: Grim.

Remediations (10)

  • MalwareBazaar | Browse malware samples - abuse.ch
    web:bazaar.abuse.ch

    Using the form below, you can search for malware samples by a hash (MD5, SHA256, SHA1 ), imphash, tlsh hash , ClamAV signature, tag or malware family. Browse Database

  • MalwareBazaar | VShell
    web:bazaar.abuse.ch

    A malware sample can be associated with only one malware family. The page below gives you an overview on malware samples that MalwareBazaar has identified as VShell .

  • Hash Reputation Checker — MD5/SHA-256 Malware Lookup
    web:cipherssecurity.com

    Check MD5, SHA-1 , or SHA-256 file hashes against MalwareBazaar and VirusTotal feeds. Drop a file — hashing happens in your browser, never uploaded.

  • Malware Hash Lookup — Check MD5, SHA-1 & SHA-256
    web:imalware.com

    It compares a file's fingerprint (its MD5, SHA-1 or SHA-256 hash ) with a list of fingerprints of known malware . If the hash matches, the file is identical to a known malicious sample .

  • Hash Checker - File & Malware Hash Lookup | InventiveHQ
    web:inventivehq.com

    Check any file hash in seconds. Paste an MD5, SHA-1 or SHA-256 hash , or drop a file to hash it locally, then check it against live malware feeds.

  • Malware Hashes - File Hash Intelligence | isMalicious
    web:ismalicious.com

    Database of known malware file hashes. MD5, SHA1 , and SHA256 hashes with malware family classification. Updated daily from sandbox analysis and vendor feeds.

  • File Hash Checker — Look Up MD5, SHA-1 & SHA-256 Hashes
    web:osintdashboard.dev

    Look up MD5, SHA-1 , or SHA-256 file hashes against malware databases to check if a file is known malicious.

  • Free File & Hash Scanner — Check Files for Malware · PhishScan
    web:phishscan.io

    Free File & Hash Scanner Check any file or hash for malware — VirusTotal, ClamAV and YARA in one click.

  • Check Any File Against Our Malware Hash Database | Team Cymru
    web:www.team-cymru.com

    Check MD5, SHA-1 , or SHA-256 hashes against 30+ antivirus databases. Team Cymru's Malware Hash Registry speeds triage via HTTPS, DNS, or WHOIS.

  • The Silent, Fileless Threat of VShell - trellix.com
    web:www.trellix.com

    The Silent, Fileless Threat of VShell By Sagar Bade · August 21, 2025 Introduction Linux environments are often seen as bastions of security, favored by developers, sysadmins, and security professionals for their stability, transparency, and resistance to malware . Compared to Windows, the attack surface is perceived to be smaller, and users typically enjoy a greater degree of control. But ...

AI Forensic Analysis

Only Available for Registered Users. Sign in to view.