MalwareUsed by 1 actor

ShellClient

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

MalKamak

The Nocturnus Team uncovered a previously undocumented and stealthy RAT (Remote Access Trojan) dubbed ShellClient which was employed as the primary espionage tool.

via cybereason blogcybereason.com

MITRE ATT&CK

Techniques & procedures

19 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1078Valid AccountsEvidence1

The attackers were observed using PAExec and “net use” for lateral movement.

Execution

2 techniques

T1047Windows Management InstrumentationEvidence1

When either of the -c or -d arguments are provided, the malware performs basic fingerprinting using WMI... code38 Lateral movement using WMI

T1059Command and Scripting InterpreterEvidence1

The executable contains multiple command functions that enable its capabilities, including arbitrary command execution... code20 Start a CMD shell code21 Start a PowerShell shell ... Code26 Execute a shell command

Persistence

2 techniques

T1078Valid AccountsEvidence1

The attackers were observed using PAExec and “net use” for lateral movement.

T1543.003Windows ServiceEvidence1

The ShellClient RAT achieves persistence and privilege escalation to run with SYSTEM privileges on victim machines by creating the nhdService disguised as Network Hosts Detection Service

Privilege Escalation

2 techniques

T1078Valid AccountsEvidence1

The attackers were observed using PAExec and “net use” for lateral movement.

T1543.003Windows ServiceEvidence1

The ShellClient RAT achieves persistence and privilege escalation to run with SYSTEM privileges on victim machines by creating the nhdService disguised as Network Hosts Detection Service

Stealth

3 techniques

T1027Obfuscated Files or InformationEvidence1

The executable stores most of the its strings, including configuration strings, as bytes and then converts them in real-time to Unicode/ASCII to evade antivirus strings detection

T1036MasqueradingEvidence1

the malicious binary was found to be running on victim machines as “svchost.exe” while its internal name was disguised as “RuntimeBroker.exe”

T1078Valid AccountsEvidence1

The attackers were observed using PAExec and “net use” for lateral movement.

Credential Access

1 technique

T1003OS Credential DumpingEvidence1

the ShellClient RAT activity group deployed and executed an unknown executable named lsa.exe to perform credential dumping. Lsa.exe dumped the memory of lsass.exe to a file named debug.bin

Discovery

3 techniques

T1016System Network Configuration DiscoveryEvidence1

Networking Information including a request to ipinfo[.]io/ip to retrieve the public IP address of the infected machine

T1082System Information DiscoveryEvidence1

the malware performs basic fingerprinting using WMI to collect: Hardware information such as BIOS information, Mac address, etc.

T1518.001Security Software DiscoveryEvidence1

the malware performs basic fingerprinting using WMI to collect... Which antivirus products are installed

Lateral Movement

1 technique

T1021.002SMB/Windows Admin SharesEvidence1

The attackers were observed using PAExec and “net use” for lateral movement.

Collection

1 technique

T1560Archive Collected DataEvidence1

In order to exfiltrate data, the attackers used WinRar to compress important files before data exfiltration using a renamed rar.exe WinRar file

Command and Control

4 techniques

T1071.001Web ProtocolsEvidence1

The destinations for these communications will be api.dropboxdapi[.]com and content.dropboxapi[.]com

T1071.002File Transfer ProtocolsEvidence1

ExtensionLib.dll contains utilities... FTP Client Telnet Client ... code24 Start a FTP client

T1132Data EncodingEvidence1

Before communicating, it encrypts the data using an hardcoded AES encryption key.

T1573Encrypted ChannelEvidence1

Before communicating, it encrypts the data using an hardcoded AES encryption key.

Exfiltration

3 techniques

T1041Exfiltration Over C2 ChannelEvidence1

the ShellClient authors chose to abandon their previous C2 domain and replace the command and control mechanism of the malware with a more simple yet more stealthy C2 channel using Dropbox to exfiltrate the stolen data as well as to send commands to the malware

T1048Exfiltration Over Alternative ProtocolEvidence1

In each new iteration of the malware, the authors added new features and capabilities, attempting to use various exfiltration protocols and methods, such as using an FTP client and a Dropbox account

T1567Exfiltration Over Web ServiceEvidence1

The most recent ShellClient versions were observed to be abusing cloud-based storage services for Command and Control (C2), in this case the popular Dropbox service

INDICATORS OF COMPROMISE

IOCs tracked for this family

5 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

5 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app8 years ago

ip.v4●●●●●●●●●●●●View more in app8 years ago

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

picus security blogNews

Nov 11, 2025

MalKamak APT’s ShellClient RAT: Inside Operation GhostShell

ShellClient is a modular, stealthy Remote Access Trojan (RAT) used by the MalKamak APT group for espionage. It provides remote access, data exfiltration, credential dumping, and persistence on compromised systems. It uses encrypted communication with Dropbox as its command and control channel, masquerades as legitimate Windows processes, and employs various defense evasion techniques.

cybereason blogNews

Nov 6, 2018

Operation GhostShell: Novel RAT Targets Global Aerospace and Telecoms Firms

A stealthy modular remote access trojan used for cyber espionage. It performs reconnaissance, fingerprinting, command execution, file operations, FTP/Telnet access, lateral movement via WMI, persistence as a Windows service, and exfiltration/C2 through Dropbox API using AES-encrypted data.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching5

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping19

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareUsed by 1 actor

ShellClient

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

MalKamak

The Nocturnus Team uncovered a previously undocumented and stealthy RAT (Remote Access Trojan) dubbed ShellClient which was employed as the primary espionage tool.

via cybereason blogcybereason.com

MITRE ATT&CK

Techniques & procedures

19 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1078Valid AccountsEvidence1

The attackers were observed using PAExec and “net use” for lateral movement.

Execution

2 techniques

T1047Windows Management InstrumentationEvidence1

When either of the -c or -d arguments are provided, the malware performs basic fingerprinting using WMI... code38 Lateral movement using WMI

T1059Command and Scripting InterpreterEvidence1

Persistence

2 techniques

T1078Valid AccountsEvidence1

The attackers were observed using PAExec and “net use” for lateral movement.

T1543.003Windows ServiceEvidence1

The ShellClient RAT achieves persistence and privilege escalation to run with SYSTEM privileges on victim machines by creating the nhdService disguised as Network Hosts Detection Service

Privilege Escalation

2 techniques

T1078Valid AccountsEvidence1

The attackers were observed using PAExec and “net use” for lateral movement.

T1543.003Windows ServiceEvidence1

The ShellClient RAT achieves persistence and privilege escalation to run with SYSTEM privileges on victim machines by creating the nhdService disguised as Network Hosts Detection Service

Stealth

3 techniques

T1027Obfuscated Files or InformationEvidence1

The executable stores most of the its strings, including configuration strings, as bytes and then converts them in real-time to Unicode/ASCII to evade antivirus strings detection

T1036MasqueradingEvidence1

the malicious binary was found to be running on victim machines as “svchost.exe” while its internal name was disguised as “RuntimeBroker.exe”

T1078Valid AccountsEvidence1

The attackers were observed using PAExec and “net use” for lateral movement.

Credential Access

1 technique

T1003OS Credential DumpingEvidence1

the ShellClient RAT activity group deployed and executed an unknown executable named lsa.exe to perform credential dumping. Lsa.exe dumped the memory of lsass.exe to a file named debug.bin

Discovery

3 techniques

T1016System Network Configuration DiscoveryEvidence1

Networking Information including a request to ipinfo[.]io/ip to retrieve the public IP address of the infected machine

T1082System Information DiscoveryEvidence1

the malware performs basic fingerprinting using WMI to collect: Hardware information such as BIOS information, Mac address, etc.

T1518.001Security Software DiscoveryEvidence1

the malware performs basic fingerprinting using WMI to collect... Which antivirus products are installed

Lateral Movement

1 technique

T1021.002SMB/Windows Admin SharesEvidence1

The attackers were observed using PAExec and “net use” for lateral movement.

Collection

1 technique

T1560Archive Collected DataEvidence1

In order to exfiltrate data, the attackers used WinRar to compress important files before data exfiltration using a renamed rar.exe WinRar file

Command and Control

4 techniques

T1071.001Web ProtocolsEvidence1

The destinations for these communications will be api.dropboxdapi[.]com and content.dropboxapi[.]com

T1071.002File Transfer ProtocolsEvidence1

ExtensionLib.dll contains utilities... FTP Client Telnet Client ... code24 Start a FTP client

T1132Data EncodingEvidence1

Before communicating, it encrypts the data using an hardcoded AES encryption key.

T1573Encrypted ChannelEvidence1

Before communicating, it encrypts the data using an hardcoded AES encryption key.

Exfiltration

3 techniques

T1041Exfiltration Over C2 ChannelEvidence1

T1048Exfiltration Over Alternative ProtocolEvidence1

In each new iteration of the malware, the authors added new features and capabilities, attempting to use various exfiltration protocols and methods, such as using an FTP client and a Dropbox account

T1567Exfiltration Over Web ServiceEvidence1

The most recent ShellClient versions were observed to be abusing cloud-based storage services for Command and Control (C2), in this case the popular Dropbox service

INDICATORS OF COMPROMISE

IOCs tracked for this family

5 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

5 tracked

IPs, domains, and DNS infrastructure linked to this family.

TypeValueLatest sighting

domain●●●●●●●●●●●●View more in app8 years ago

ip.v4●●●●●●●●●●●●View more in app8 years ago

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

picus security blogNews

Nov 11, 2025

MalKamak APT’s ShellClient RAT: Inside Operation GhostShell

cybereason blogNews

Nov 6, 2018

Operation GhostShell: Novel RAT Targets Global Aerospace and Telecoms Firms

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching5

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping19

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.