PerlBotMalware
- ddos perl ircbot
- ShellBot
Last reported 17 days ago, by AhnLab ASEC1 report
ATT&CK techniques
2 techniques · each with the sentence it comes from- T1014Rootkit
“… successfully logging in, the threat actors downloaded and executed ShellBot using wget or curl, and subsequently installed a user-mode rootkit, XHide, and XMRig through a downloader.”
- T1110Brute Force
“The targets were Linux SSH servers accessed through brute force attacks, dictionary attacks, and certain vulnerability exploits.”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
1 report, newest first · the exact sentence from each-
Statistical Report on Malware Targeting Linux SSH Servers in the Third Quarter of 2026“In the third quarter of 2026, cases were identified in which ShellBot and the backdoor malware Fisieredoor were used.”
Indicators in its reports
named in the reports above- hxxp://13.71.2[.]244/.x/xin 1 report
- 103.157.217[.]38in 1 report
- 128.199.127[.]217in 1 report
- 04f5d13f78ca2ab39a8f777885c2a474in 1 report
- 0e3d8bc69fe996dbd681c01f509e8591in 1 report
- 2a9e5e25776fff5430f2dd06335920a4in 1 report
- 3df700b3c1d0ffab386397f4e59c5b23in 1 report
- 5279c09bdabb12a3a28b0db8e838bf1bin 1 report
- hxxp://13.71.2[.]244/.x/pax.txtin 1 report
- 13.71.2[.]244in 1 report
- hxxp://13.71.2[.]244/.x/sys_usersin 1 report
- hxxp://13.71.2[.]244/.x/xmrigroot.tgzin 1 report
- hxxp://177.22.88[.]133:8080/.x/.sys/sys_usersin 1 report
- 177.22.88[.]133in 1 report
- 159.65.54[.]221in 1 report
Copy these 15 indicators · defanged
Thanks — we review every report.