MalwareExploits 1 CVE

Stealth Shellbot

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

1 CVES

CVE-2022-22954Server-Side Template Injection RCE in VMware Workspace ONE Access and Identity ManagerExploited in the wild

CVE-2022-22954, a remote code execution (RCE) vulnerability due to server-side template injection in VMware Workspace ONE Access and Identity Manager, is trivial to exploit with a single HTTP request to a vulnerable device.

via palo alto networks unit 42 blogunit42.paloaltonetworks.com

MITRE ATT&CK

Techniques & procedures

13 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

4 techniques

T1059Command and Scripting InterpreterEvidence1

Certain injected commands result in the download of obfuscated Perl scripts. Deobfuscating these scripts reveals they are versions of the known bot family “Stealth Shellbot” that reaches out to an IRC server to listen for commands to perform.

T1059.004Unix ShellEvidence1

The attack starts when tddwrt7s.sh downloads the dota3.tar.gz package from a C2 server. The extracted initall.sh script executes, kicking off the infection chain.

T1059.006PythonEvidence1

The run script contains three base64-encoded blobs, which are piped to perl ... Upon base64 decoding, obfuscated perl scripts are identified.

T1203Exploitation for Client ExecutionEvidence1

Persistence

1 technique

T1098.004SSH Authorized KeysEvidence2

The malware removes and recreates the victim’s ~/.ssh folder, injects an attacker-controlled SSH public key, and re-applies restrictive permissions.

Privilege Escalation

1 technique

T1098.004SSH Authorized KeysEvidence2

The malware removes and recreates the victim’s ~/.ssh folder, injects an attacker-controlled SSH public key, and re-applies restrictive permissions.

Stealth

2 techniques

T1027Obfuscated Files or InformationEvidence3

These init scripts all use variable-based string concatenation obfuscation, where commands are split into small variable fragments that are dynamically concatenated and executed.

T1140Deobfuscate/Decode Files or InformationEvidence1

The run script contains three base64-encoded blobs, which are piped to perl.

Defense Impairment

2 techniques

T1222File and Directory Permissions ModificationEvidence1

The script ends off with installing its own SSH public key for persistent access, setting restrictive permissions, and making the directory immutable to prevent modification through chattr.

T1222.002Linux and Mac File and Directory Permissions ModificationEvidence1

The script grants execution permissions to the upd file and '777' permissions to all files in its folder. The malware also uses chattr +ia to prevent modification.

Command and Control

4 techniques

T1071Application Layer ProtocolEvidence1

SHELLBOT scripts operate as IRC-based backdoors, allowing attackers to remotely control infected machines via predefined commands sent through an IRC channel.

T1071.001Web ProtocolsEvidence1

STEALTH SHELLBOT for remote control via IRC C2... SHELLBOT scripts operate as IRC-based backdoors, allowing attackers to remotely control infected machines via predefined commands sent through an IRC channel.

T1095Non-Application Layer ProtocolEvidence1

Deobfuscating these scripts reveals they are versions of the known bot family “Stealth Shellbot” that reaches out to an IRC server to listen for commands to perform.

T1105Ingress Tool TransferEvidence1

The injected commands worth mentioning that intended to further download payloads to a vulnerable machine can be categorized into the following broad categories: Mirai/Gafgyt dropper scripts or variants Webshells Perl Shellbot Coinminers Scanning/Callbacks

INDICATORS OF COMPROMISE

IOCs tracked for this family

6 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

3 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

3 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in app4 years ago

ip.v4●●●●●●●●●●●●View more in app4 years ago

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

elastic security labsNews

Apr 1, 2025

Outlaw Linux Malware: Persistent, Unsophisticated, and Surprisingly Effective - Elastic Security Labs

Publicly available IRC-based backdoor scripts used by OUTLAW for command-and-control, arbitrary command execution, payload download/execution, and persistence.

elastic security labsNews

Apr 1, 2025

Outlaw Linux Malware: Persistent, Unsophisticated, and Surprisingly Effective

Obfuscated Perl IRC bot/backdoor used by OUTLAW as a secondary remote-control and persistence mechanism. It connects to an attacker-controlled IRC C2 and can execute shell commands, download and execute payloads, manage malware components, and, in older variants, perform DDoS activity.

palo alto networks unit 42 blogNews

May 20, 2022

Threat Brief: VMware Vulnerabilities Exploited in the Wild (CVE-2022-22954 and Others)

An IRC-controlled bot family delivered via obfuscated Perl scripts; it can receive commands, execute shell commands, and make HTTP requests to support scanning and exploitation activity.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching6

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities1

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping13

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

MalwareExploits 1 CVE

Stealth Shellbot

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

1 CVES

CVE-2022-22954Server-Side Template Injection RCE in VMware Workspace ONE Access and Identity ManagerExploited in the wild

via palo alto networks unit 42 blogunit42.paloaltonetworks.com

MITRE ATT&CK

Techniques & procedures

13 distinct techniques documented for this family, organized by ATT&CK tactic.

Execution

4 techniques

T1059Command and Scripting InterpreterEvidence1

T1059.004Unix ShellEvidence1

The attack starts when tddwrt7s.sh downloads the dota3.tar.gz package from a C2 server. The extracted initall.sh script executes, kicking off the infection chain.

T1059.006PythonEvidence1

The run script contains three base64-encoded blobs, which are piped to perl ... Upon base64 decoding, obfuscated perl scripts are identified.

T1203Exploitation for Client ExecutionEvidence1

Persistence

1 technique

T1098.004SSH Authorized KeysEvidence2

The malware removes and recreates the victim’s ~/.ssh folder, injects an attacker-controlled SSH public key, and re-applies restrictive permissions.

Privilege Escalation

1 technique

T1098.004SSH Authorized KeysEvidence2

The malware removes and recreates the victim’s ~/.ssh folder, injects an attacker-controlled SSH public key, and re-applies restrictive permissions.

Stealth

2 techniques

T1027Obfuscated Files or InformationEvidence3

These init scripts all use variable-based string concatenation obfuscation, where commands are split into small variable fragments that are dynamically concatenated and executed.

T1140Deobfuscate/Decode Files or InformationEvidence1

The run script contains three base64-encoded blobs, which are piped to perl.

Defense Impairment

2 techniques

T1222File and Directory Permissions ModificationEvidence1

The script ends off with installing its own SSH public key for persistent access, setting restrictive permissions, and making the directory immutable to prevent modification through chattr.

T1222.002Linux and Mac File and Directory Permissions ModificationEvidence1

The script grants execution permissions to the upd file and '777' permissions to all files in its folder. The malware also uses chattr +ia to prevent modification.

Command and Control

4 techniques

T1071Application Layer ProtocolEvidence1

SHELLBOT scripts operate as IRC-based backdoors, allowing attackers to remotely control infected machines via predefined commands sent through an IRC channel.

T1071.001Web ProtocolsEvidence1

T1095Non-Application Layer ProtocolEvidence1

Deobfuscating these scripts reveals they are versions of the known bot family “Stealth Shellbot” that reaches out to an IRC server to listen for commands to perform.

T1105Ingress Tool TransferEvidence1

INDICATORS OF COMPROMISE

IOCs tracked for this family

6 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

3 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

3 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

TypeValueLatest sighting

hash.sha256●●●●●●●●●●●●View more in app4 years ago

ip.v4●●●●●●●●●●●●View more in app4 years ago

ACTIVITY FEED

Recent activity

3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

3 SOURCESView more in app

elastic security labsNews

Apr 1, 2025

Outlaw Linux Malware: Persistent, Unsophisticated, and Surprisingly Effective - Elastic Security Labs

Publicly available IRC-based backdoor scripts used by OUTLAW for command-and-control, arbitrary command execution, payload download/execution, and persistence.

elastic security labsNews

Apr 1, 2025

Outlaw Linux Malware: Persistent, Unsophisticated, and Surprisingly Effective

palo alto networks unit 42 blogNews

May 20, 2022

Threat Brief: VMware Vulnerabilities Exploited in the Wild (CVE-2022-22954 and Others)

An IRC-controlled bot family delivered via obfuscated Perl scripts; it can receive commands, execute shell commands, and make HTTP requests to support scanning and exploitation activity.

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching6

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities1

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping13

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.