Tool
ShellExecuteW
- First Reported
- Apr 22, 2026
- Latest Reported
- Apr 22, 2026
Reported Context (1)
- Subsequently, TOSHIS loader downloads the PDF decoy from 58.247.193[.]100 and opens it using ShellExecuteW. TOSHIS loader then retrieves a second-stage shellcode from the same IP address, decrypts it using Tropic Trooper Uses AdaptixC2 and GitHub C2 to Establish VS Code Tunnel Access
Malware (5)
Threat Actors (3)
MITRE ATT&CK (11)
Vendors (1)
Products (2)
Tools (2)
Countries (3)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.