⚠️ Overview

Reshell is a remote access trojan (RAT) first documented by Palo Alto Networks Unit 42 in September 2020, attributed to the Chinese state‑sponsored threat group tracked as TA428 (also associated with APT10). It operates as a PowerShell‑based backdoor designed to establish persistent, stealthy C2 channels through encrypted HTTPS traffic, categorized as a RAT and credential stealer.

🔧 Technical Capabilities

Reshell primarily propagates via spear‑phishing emails carrying malicious Office documents that drop a PowerShell loader. The loader downloads the core payload from a remote server using Invoke-Expression. The C2 infrastructure relies on HTTPS‑encrypted communications to blend with normal web traffic, often using legitimate cloud providers like Cloudflare for domain fronting. Persistence is achieved by writing a scheduled task or creating a registry Run key under HKCUSoftwareMicrosoftWindowsCurrentVersionRun with a base64‑encoded PowerShell command. For evasion, Reshell employs obfuscation via variable renaming, string splitting, and AES‑encrypted payloads; it also checks for sandbox artifacts (e.g., small screen resolution, low memory) before executing. The RAT can execute arbitrary shell commands, upload/download files, and perform keylogging through injected .NET assemblies.

📜 History & Notable Incidents

First identified in September 2020 by Unit 42 during a campaign targeting telecommunications and government entities in Southeast Asia. A notable incident involved the exfiltration of VPN credentials from a major Asian telecom provider. No CVEs are directly exploited; instead, the malware relies on user interaction (opening phishing attachments) to achieve initial access. Law enforcement actions have not been publicly linked to Reshell operations as of early 2025.

🔍 Detection Indicators

Known SHA‑256 hash from Unit 42 reports: ef4a7b3c... (truncated) — exact hash available in Palo Alto Networks’ GitHub IOC repository. Behavioral signatures include PowerShell spawning cmd.exe to execute encoded commands, registry modifications under HKCUSoftwareMicrosoftWindowsCurrentVersionRun with a value name beginning with Updater, and network connections to domains following the pattern *.reshell[.]com or *.cdn‑update[.]net. The malicious User‑Agent string is Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/85.0.4183.121 Safari/537.36. No mutex names have been publicly documented.

☠️ Risk & Impact

Reshell enables full remote control of infected hosts, leading to credential theft, data exfiltration, and lateral movement within targeted networks. The primary sectors affected are telecommunications, government, and defense in Asia‑Pacific. Financial losses are not publicly quantified, but the exfiltration of sensitive network credentials poses long‑term espionage risks.

🛡️ Mitigation

Enable PowerShell logging and block execution of unsigned scripts via AppLocker or WDAC. Deploy endpoint detection rules that flag encoded PowerShell commands and anomalous outbound HTTPS to unknown domains. Run regular antivirus scans with updated signatures from vendors such as Palo Alto Networks and Trend Micro.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.