MalwareExploits 1 CVE

Stealth Shellbot

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

1 CVES

CVE-2022-22954VMware Workspace ONE Access and Identity Manager Server-Side Template Injection RCEExploited in the wild

CVE-2022-22954, a remote code execution (RCE) vulnerability due to server-side template injection in VMware Workspace ONE Access and Identity Manager, is trivial to exploit with a single HTTP request to a vulnerable device.

via palo alto networks unit 42 blogunit42.paloaltonetworks.com

MITRE ATT&CK

Techniques & procedures

9 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

3 techniques

T1059Command and Scripting InterpreterEvidence1

Certain injected commands result in the download of obfuscated Perl scripts. Deobfuscating these scripts reveals they are versions of the known bot family “Stealth Shellbot” that reaches out to an IRC server to listen for commands to perform.

T1059.006PythonEvidence1

The run script contains three base64-encoded blobs, which are piped to perl ... Upon base64 decoding, obfuscated perl scripts are identified.

T1203Exploitation for Client ExecutionEvidence1

Persistence

1 technique

T1098.004SSH Authorized KeysEvidence1

The malware removes and recreates the victim’s ~/.ssh folder, injects an attacker-controlled SSH public key, and re-applies restrictive permissions... This grants persistent SSH access.

Privilege Escalation

1 technique

T1098.004SSH Authorized KeysEvidence1

The malware removes and recreates the victim’s ~/.ssh folder, injects an attacker-controlled SSH public key, and re-applies restrictive permissions... This grants persistent SSH access.

Stealth

1 technique

T1027Obfuscated Files or InformationEvidence2

These init scripts all use variable-based string concatenation obfuscation... The run script contains three base64-encoded blobs... obfuscated perl scripts are identified... Additionally, the malware's binaries are packed with UPX.

Defense Impairment

1 technique

T1222File and Directory Permissions ModificationEvidence1

The script ends off with installing its own SSH public key for persistent access, setting restrictive permissions, and making the directory immutable to prevent modification through chattr.

Command and Control

3 techniques

T1071.001Web ProtocolsEvidence1

STEALTH SHELLBOT for remote control via IRC C2... SHELLBOT scripts operate as IRC-based backdoors, allowing attackers to remotely control infected machines via predefined commands sent through an IRC channel.

T1095Non-Application Layer ProtocolEvidence1

Deobfuscating these scripts reveals they are versions of the known bot family “Stealth Shellbot” that reaches out to an IRC server to listen for commands to perform.

T1105Ingress Tool TransferEvidence1

The injected commands worth mentioning that intended to further download payloads to a vulnerable machine can be categorized into the following broad categories: Mirai/Gafgyt dropper scripts or variants Webshells Perl Shellbot Coinminers Scanning/Callbacks

INDICATORS OF COMPROMISE

IOCs tracked for this family

6 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

3 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

3 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in app4 years ago

ip.v4●●●●●●●●●●●●View more in app4 years ago

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

elastic security labsNews

Apr 1, 2025

Outlaw Linux Malware: Persistent, Unsophisticated, and Surprisingly Effective - Elastic Security Labs

Publicly available IRC-based backdoor scripts used by OUTLAW for command-and-control, arbitrary command execution, payload download/execution, and persistence.

palo alto networks unit 42 blogNews

May 20, 2022

Threat Brief: VMware Vulnerabilities Exploited in the Wild (CVE-2022-22954 and Others)

An IRC-controlled bot family delivered via obfuscated Perl scripts; it can receive commands, execute shell commands, and make HTTP requests to support scanning and exploitation activity.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching6

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities1

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping9

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareExploits 1 CVE

Stealth Shellbot

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

1 CVES

CVE-2022-22954VMware Workspace ONE Access and Identity Manager Server-Side Template Injection RCEExploited in the wild

via palo alto networks unit 42 blogunit42.paloaltonetworks.com

MITRE ATT&CK

Techniques & procedures

9 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

3 techniques

T1059Command and Scripting InterpreterEvidence1

T1059.006PythonEvidence1

The run script contains three base64-encoded blobs, which are piped to perl ... Upon base64 decoding, obfuscated perl scripts are identified.

T1203Exploitation for Client ExecutionEvidence1

Persistence

1 technique

T1098.004SSH Authorized KeysEvidence1

The malware removes and recreates the victim’s ~/.ssh folder, injects an attacker-controlled SSH public key, and re-applies restrictive permissions... This grants persistent SSH access.

Privilege Escalation

1 technique

T1098.004SSH Authorized KeysEvidence1

The malware removes and recreates the victim’s ~/.ssh folder, injects an attacker-controlled SSH public key, and re-applies restrictive permissions... This grants persistent SSH access.

Stealth

1 technique

T1027Obfuscated Files or InformationEvidence2

Defense Impairment

1 technique

T1222File and Directory Permissions ModificationEvidence1

The script ends off with installing its own SSH public key for persistent access, setting restrictive permissions, and making the directory immutable to prevent modification through chattr.

Command and Control

3 techniques

T1071.001Web ProtocolsEvidence1

T1095Non-Application Layer ProtocolEvidence1

Deobfuscating these scripts reveals they are versions of the known bot family “Stealth Shellbot” that reaches out to an IRC server to listen for commands to perform.

T1105Ingress Tool TransferEvidence1

INDICATORS OF COMPROMISE

IOCs tracked for this family

6 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

3 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

3 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in app4 years ago

ip.v4●●●●●●●●●●●●View more in app4 years ago

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

elastic security labsNews

Apr 1, 2025

Outlaw Linux Malware: Persistent, Unsophisticated, and Surprisingly Effective - Elastic Security Labs

Publicly available IRC-based backdoor scripts used by OUTLAW for command-and-control, arbitrary command execution, payload download/execution, and persistence.

palo alto networks unit 42 blogNews

May 20, 2022

Threat Brief: VMware Vulnerabilities Exploited in the Wild (CVE-2022-22954 and Others)

An IRC-controlled bot family delivered via obfuscated Perl scripts; it can receive commands, execute shell commands, and make HTTP requests to support scanning and exploitation activity.

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching6

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities1

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping9

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.