Anyone else observing some changes around #vshell recently? There seems to be some development progress. E.g. https://bazaar.abuse.ch/sample/bf8a8241e1d114be03550e909ddb8fb354d84b1e9c1b8a29c809de0160d74ee6/ which for example has no detections on VT and uses a different way to store its config.
Beside key and salt values, which are available as plaintext, the sample uses the string "vshell2" to derive the decryption key - a new version?