Shell malware family
Shell is a malware family tracked by MalwareAnalyzer by Cyble across 2 publicly analyzed samples. First seen 2026-08-02, most recently 2026-08-02. Observed ATT&CK techniques include T1105.
Corpus statistics
- Publicly analyzed samples: 2
- First seen: 2026-08-02
- Last seen: 2026-08-02
- Verdicts: malicious 1, suspicious 1
- File types: shell 1, unknown 1
ATT&CK techniques used by Shell
- T1105 - 1 sample
Extracted command-and-control infrastructure
- https://api.telegram.org/bot8726411290:AAE766fgz5OEcXJXwLzqGqA_zJ-Fo63rYTA/sendDocument - 1 sample
- https://store.grafsynergy.com/media/apple.png - 1 sample
Recent Shell samples
- 20d3ab93bd112552323257e3fa7e096531d9ff69daf8b3cc807869e094e13efb.unknown - suspicious (2026-08-02)
- 37edd2381325114990174f341e9de27a1fbf77eeb579904460b991ebfb5418bf.sh - malicious (2026-08-02)
Frequently asked about Shell
- What is Shell?
- Shell is a malware family tracked by MalwareAnalyzer by Cyble across 2 publicly analyzed samples. First seen 2026-08-02, most recently 2026-08-02. Observed ATT&CK techniques include T1105.
- How many Shell samples have been analyzed?
- MalwareAnalyzer by Cyble holds 2 publicly analyzed samples attributed to Shell, first seen 2026-08-02 and most recently 2026-08-02. This counts public submissions to this platform only, so it is a measure of what we have seen rather than of the family's total prevalence.
- What MITRE ATT&CK techniques does Shell use?
- Across our Shell samples the most frequently observed techniques are T1105 (1). Counts are the number of analyzed samples in which each technique was observed.
- What file types does Shell use?
- Shell samples in this corpus are distributed as shell (1), unknown (1).
- Does Shell use command-and-control infrastructure?
- Yes. 2 distinct command-and-control indicators have been extracted from Shell samples, either from static configuration or from traffic captured during sandbox detonation. The full list is published on the family page.
- Is Shell malicious?
- 1 of 2 analyzed Shell samples were scored malicious by the fused verdict, which combines multi-engine static scanning, YARA and hash reputation with behavior captured during real sandbox detonation. Each report lists every signal that contributed to its score.
Latest analyzed threats · ATT&CK coverage across the corpus · Threat trends