ShellBot
ShellBot is a Perl-based Linux bot/backdoor commonly described as an IRC bot with remote shell, scanning, and DDoS functionality. The provided reporting ties it to brute-force and dictionary attacks against weakly secured Linux SSH servers, where attackers scan for exposed SSH services, gain access with weak credentials, and install the bot. Once deployed, ShellBot connects to command-and-control infrastructure over IRC, allowing operators to issue commands, steal data, and launch DDoS attacks. It can persist through startup-script modification or cron jobs, and one report notes a variant disguised itself as an rsync process and was configured for reboot persistence via cron entries. ShellBot is also described as highly customizable, with variants including "LiGhT’s Modded perlbot v2."
The malware appears in multiple Linux-focused intrusion contexts in the source material. ASEC reported on March 13, 2023 that ShellBot was actively targeting Linux SSH servers. It is also referenced among DDoS bot families observed in honeypot telemetry against Linux SSH infrastructure in Q3 2025 and Q1 2026. Separate reporting links ShellBot delivery to exploitation of internet-exposed Cacti servers via CVE-2022-46169. Historical Shellshock exploitation also delivered ShellBot-related Perl payloads. The Outlaw group’s Linux/Unix botnet toolkit used a Perl-obfuscated installer for a Shellbot backdoor, with the bot disguising itself as rsync on infected systems.
High-confidence indicators mentioned in the content include a Perl ShellBot sample with MD5 cd23ef54e264bd84ab1a12dddceb3f48, described as connecting to 81.18.135.38 on port 443; another Perl script with MD5 b0b8a35445a4743ff6f196a4c0bba688 connecting to 94.102.52.10 on port 6667; and SHA-256 sample hashes 2220783661db230d0808a5750060950688e2618d462ccbe07f54408154c227c1, b7d62d1a145ddda241e624ef94ab31fcca1a13f79e130d0a704586e35745282a, e476b9c07fcd80824d4eafce0e826ae1c12706ca6215eb6e3995468374bb8a76, f5a26a68344c1ffd136ba73dec9d08f61212872cdba33bd4d7d32733a72e4ed5, 0857f90be97326ff45f17ec3f6ce60d9a0f6d8faed34e48527fde5ec30bd5a0d, 0c1673e442b945a0aecf60d3970e924b16bd72d46e257bd72927821e4ebbc9ca, 1f3c279ea684d5cbdc7004819bf15a160f70b2c79c4affd309f9ab3ad957045b, 5ba1d0efb313ccc20e3d5f2476a3db811e15c80c3f1ac73b7a02d80c5c49c728, a26de5b607e3a66af8b7db2c13bcd1c658817649c699f8731db6f237c3c5b1ce, and cb80570332e3e32037f426e835d05bdcd276e9e5acfd439027d788dd64dcb47d.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
5 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The exploitation of the BASH bug, now widely referred to as “Shellshock”, is in full swing... The initial patch for this vulnerability (CVE-2014-6271), which was released in sync with the vulnerability’s public disclosure, was quickly found to be inadequate. | The Perl script (md5: cd23ef54e264bd84ab1a12dddceb3f48) was first submitted to VirusTotal over a year ago and is known as ShellBot. It is an IRC bot with remote shell, scanning, and DDoS functionality.
This time, the group explored unpatched systems vulnerable to CVE-2016-8655 and Dirty COW exploit (CVE-2016-5195) as attack vectors.
This time, the group explored unpatched systems vulnerable to CVE-2016-8655 ... as attack vectors.
The Perl script (md5: cd23ef54e264bd84ab1a12dddceb3f48) was first submitted to VirusTotal over a year ago and is known as ShellBot. It is an IRC bot with remote shell, scanning, and DDoS functionality.
"...allowing threat actors to breach internet-exposed Cacti servers to deliver botnet malware such as MooBot and ShellBot."
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The a binary is a script wrapper to start run, a Perl-obfuscated script for installation of a Shellbot to gain control of the infected system. The Shellbot disguises itself as a process named rsync... Shellbot is also used to control the botnet...
Techniques & procedures
16 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
2 techniques
Initial Access
Execution
3 techniques
Execution
It then resets cron and removes possible cache files from other programs, starts scripts and binaries a, init0, and start, and sets the persistence by modifying the crontab.
Persistence
3 techniques
Persistence
After gaining access, ShellBot is deployed, often achieving persistence by modifying startup scripts or cron jobs.
Privilege Escalation
3 techniques
Privilege Escalation
After gaining access, ShellBot is deployed, often achieving persistence by modifying startup scripts or cron jobs.
Stealth
3 techniques
Stealth
The commands above Base64 decode the initial string into the following python code below and execute it with Python.
Defense Impairment
1 technique
Defense Impairment
Credential Access
1 technique
Credential Access
Lateral Movement
1 technique
Lateral Movement
Command and Control
3 techniques
Command and Control
Tsunami/Kaiten... mainly functions as a DDoS client, but also has backdoor capabilities, communicating over IRC... ShellBot... It is an IRC bot with remote shell, scanning, and DDoS functionality.
Cowrie не только логирует команды — он ещё и перехватывает файлы , которые на него заливают... Все семь ботов «скачивали» на мой сервер один и тот же файл... Отпечаток у всех семи закачек оказался идентичным: a8460f446be540410004b1a8db4083773fa46f7fe76fa84219c93daa1669f8f2
IOCs tracked for this family
49 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A named malware family included in the report tags related to Linux SSH server threats.
ShellBot is a Linux DDoS bot used to launch denial-of-service attacks from compromised servers.
A Perl-based DDoS bot targeting Linux SSH servers by brute-forcing weak SSH credentials. After installation, it connects to a C2 server over IRC to receive commands, steal data, execute remote tasks, and launch DDoS attacks. It can persist through startup script or cron job modification and has customizable variants.
Botnet malware reported as a payload delivered after exploitation of internet-exposed Cacti servers (notably via CVE-2022-46169).
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.