MSShellcode malware family
MSShellcode is a malware family tracked by MalwareAnalyzer by Cyble across 5 publicly analyzed samples. First seen 2026-08-22, most recently 2026-08-25. Observed ATT&CK techniques include T1055.
Corpus statistics
- Publicly analyzed samples: 5
- First seen: 2026-08-22
- Last seen: 2026-08-25
- Verdicts: malicious 5
- File types: pe 5
ATT&CK techniques used by MSShellcode
- T1055 - 3 samples
Extracted command-and-control infrastructure
- http://www.zeustech.net/ - 1 sample
Recent MSShellcode samples
- c289e26d72fcabc3417fa844210013d8f3bcb44ace85244e24bcf17102935003 - malicious (2026-08-25)
- 53b6b504b6a9f72d1bcd6646c047d498ece6c5853faf7368eae1f0e18fc1acb5 - malicious (2026-08-24)
- bc5a6c440a6ad3c7b6f3b693fc67d5c4a8b1534f6f4b4f44803b898d95a1df0b - malicious (2026-08-24)
- 7db14bfcd4ef55c7ba177e25aacd7a74c93de5420d50be1d1cc19bb13a9e24b5 - malicious (2026-08-23)
- 78572df61ea18c426faa9cf087676a1ab7a093bec89fa41ecedbe732416dca56 - malicious (2026-08-22)
Frequently asked about MSShellcode
- What is MSShellcode?
- MSShellcode is a malware family tracked by MalwareAnalyzer by Cyble across 5 publicly analyzed samples. First seen 2026-08-22, most recently 2026-08-25. Observed ATT&CK techniques include T1055.
- How many MSShellcode samples have been analyzed?
- MalwareAnalyzer by Cyble holds 5 publicly analyzed samples attributed to MSShellcode, first seen 2026-08-22 and most recently 2026-08-25. This counts public submissions to this platform only, so it is a measure of what we have seen rather than of the family's total prevalence.
- What MITRE ATT&CK techniques does MSShellcode use?
- Across our MSShellcode samples the most frequently observed techniques are T1055 (3). Counts are the number of analyzed samples in which each technique was observed.
- What file types does MSShellcode use?
- MSShellcode samples in this corpus are distributed as pe (5).
- Does MSShellcode use command-and-control infrastructure?
- Yes. 1 distinct command-and-control indicator has been extracted from MSShellcode samples, either from static configuration or from traffic captured during sandbox detonation. The full list is published on the family page.
- Is MSShellcode malicious?
- 5 of 5 analyzed MSShellcode samples were scored malicious by the fused verdict, which combines multi-engine static scanning, YARA and hash reputation with behavior captured during real sandbox detonation. Each report lists every signal that contributed to its score.
Latest analyzed threats · ATT&CK coverage across the corpus · Threat trends