LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S0442: VBShower

VBShower is a backdoor that has been used by Inception since at least 2019. VBShower has been used as a downloader for second stage payloads, including PowerShower.[1]

EnterpriseS0442MalwareObject v1.0Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Automated summary not available

Glexia publishes ATT&CK takes only after source-hash and schema validation. Until then, use the official MITRE definition below and the defensive relationship context on this page.

Official MITRE ATT&CK definition

VBShower

VBShower is a backdoor that has been used by Inception since at least 2019. VBShower has been used as a downloader for second stage payloads, including PowerShower.[1]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

5 rows
DomainIDNameRelationship / procedure
EnterpriseT1059.005Visual BasicSub-technique

VBShower has the ability to execute VBScript files.[1]

EnterpriseT1070.004File DeletionSub-technique

VBShower has attempted to complicate forensic analysis by deleting all the files contained in %APPDATA%\..\Local\Temporary Internet Files\Content.Word and %APPDATA%\..\Local Settings\Temporary Internet Files\Content.Word\.[1]

EnterpriseT1547.001Registry Run Keys / Startup FolderSub-technique

VBShower used HKCU\Software\Microsoft\Windows\CurrentVersion\Run\\[a-f0-9A-F]{8} to maintain persistence.[1]

EnterpriseT1071.001Web ProtocolsSub-technique

VBShower has attempted to obtain a VBS script from command and control (C2) nodes over HTTP.[1]

EnterpriseT1105Ingress Tool Transfer

VBShower has the ability to download VBS files to the target computer.[1]

Associated objects

Groups, software, and campaigns

GroupEnterprise

G0100: Inception

Inception is a cyber espionage group active since at least 2014. The group has targeted multiple industries and governmental entities primarily in Russia, but has also been active in the United States and throughout Europe, Asia, Africa, and the Middle East.[1][2][3]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1059.005: Visual BasicEnterpriseuses · TechniqueT1070.004: File DeletionEnterpriseuses · TechniqueT1547.001: Registry Run Keys / Startup FolderEnterpriseuses · TechniqueT1071.001: Web ProtocolsEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · GroupG0100: InceptionEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
20.0
Object version
1.0
Created
Modified
Raw hash
a0066a2359438eb3...
Imported snapshots across ATT&CK releases(3)
ReleaseBundle importedObject versionModifiedStatusRaw hash
20.01.0Current bundlea0066a235943…
19.21.0Older bundlea0066a235943…
19.11.0Older bundlea0066a235943…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Kaspersky Cloud Atlas August 2019

    GReAT. (2019, August 12). Recent Cloud Atlas activity. Retrieved May 8, 2020.

    Open source URL
  2. [2]
    mitre-attackS0442
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use