ShellBot, Fisieredoor & VShell Credential-Theft Campaigns Targeting Linux SSH and Windows Database Servers: OTX Pulse Analysis — Enterprise Detection Pack

---
title: ShellBot / Fisieredoor Linux SSH Brute-Force Followed by Payload Download
description: Detects successful SSH authentication after a burst of failures (dictionary/brute-force pattern) followed by download tool execution (wget/curl) — the ShellBot/Fisieredoor infection chain observed in Q3 2026 honeypot telemetry
id: 7f3a1c2e-9b4d-4e1a-a5c6-20261015a001
status: experimental
author: Security Arsenal Threat Intel
references:
  - https://asec.ahnlab.com/ko/95807/
date: 2026/10/15
logsource:
  product: linux
  category: process_creation
detection:
  selection_downloaders:
    Image|endswith:
      - '/wget'
      - '/curl'
  selection_perl_exec:
    Image|endswith:
      - '/perl'
      - '/perl5'
  selection_suspicious_paths:
    CommandLine|contains:
      - '/tmp/'
      - '/dev/shm/'
      - '/var/tmp/'
      - 'libSSL2.3.0.so'
      - 'goauto'
  condition: (selection_downloaders or selection_perl_exec) and selection_suspicious_paths
falsepositives:
  - Legitimate admin scripts downloading packages to /tmp
  - Package managers invoking curl during updates
level: high
tags:
  - attack.t1110
  - attack.t1105
  - attack.t1036
---
title: HackBrowserData Browser Credential Store Access on Database Servers
description: Detects process access to browser credential stores (Chrome/Edge/Firefox Login Data, Cookies, Local State) on Windows servers — consistent with HackBrowserData deployment following MS-SQL/MySQL brute-force compromise
id: 7f3a1c2e-9b4d-4e1a-a5c6-20261015a002
status: experimental
author: Security Arsenal Threat Intel
references:
  - https://asec.ahnlab.com/en/95809/
date: 2026/10/15
logsource:
  category: file_event
  product: windows
detection:
  selection_paths:
    TargetFilename|contains:
      - '\AppData\Local\Google\Chrome\User Data\'
      - '\AppData\Local\Microsoft\Edge\User Data\'
      - '\AppData\Roaming\Mozilla\Firefox\Profiles\'
  selection_files:
    TargetFilename|endswith:
      - '\Login Data'
      - '\Cookies'
      - '\Local State'
      - '\logins.json'
      - '\key4.db'
  filter_known_browsers:
    Image|endswith:
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
  condition: selection_paths and selection_files and not filter_known_browsers
falsepositives:
  - Enterprise password managers reading browser stores
  - Backup agents copying user profiles
level: critical
tags:
  - attack.t1555.003
  - attack.t1003
---
title: Covert Tunneling Tools — Cloudflared, SoftEther, Suo5 Execution on Servers
description: Detects execution of tunneling/proxy tools abused for C2 egress (Cloudflared, SoftEther vpnserver, Suo5, Fscan) on Windows servers, per Q3 2026 database server intrusion telemetry
id: 7f3a1c2e-9b4d-4e1a-a5c6-20261015a003
status: experimental
author: Security Arsenal Threat Intel
date: 2026/10/15
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\cloudflared.exe'
      - '\vpnserver.exe'
      - '\suo5.exe'
      - '\fscan.exe'
      - '\RingQ.exe'
  selection_hashnames:
    CommandLine|contains:
      - 'microsftapiedge.com'
      - 'update.microsftapiedge.com'
  condition: selection_img or selection_hashnames
falsepositives:
  - Legitimate Cloudflare Tunnel deployments (verify with change records)
  - Sanctioned SoftEther VPN infrastructure
level: high
tags:
  - attack.t1572
  - attack.t1090
  - attack.t1046

// Hunt: Brute-force pattern on SQL/SSH + follow-on suspicious execution & C2
// Covers: ShellBot C2 (177.22.88.133), Windows infra (38.60.253.35), microsftapiedge.com,
// HackBrowserData credential-store access, tunneling tool deployment
let BadIPs = dynamic(["177.22.88.133", "38.60.253.35"]);
let BadDomains = dynamic(["microsftapiedge.com", "update.microsftapiedge.com"]);
let SuspiciousTools = dynamic(["cloudflared.exe","vpnserver.exe","suo5.exe","fscan.exe","ringq.exe","hackbrowserdata.exe","xmrig.exe","gotohttp.exe"]);
union isfuzzy=true
(
  // 1. Network connections to known-bad infrastructure
  DeviceNetworkEvents
  | where TimeGenerated > ago(14d)
  | where RemoteIP in (BadIPs) or RemoteUrl has_any (BadDomains)
  | project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort
  | extend Hunt = "C2-Connection"
),
(
  // 2. Execution of credential stealers, miners, tunneling tools
  DeviceProcessEvents
  | where TimeGenerated > ago(14d)
  | where FileName in~ (SuspiciousTools)
     or ProcessCommandLine has_any ("libSSL2.3.0.so", "microsftapiedge", "Login Data", "key4.db")
     or SHA256 in ("1404ae6367955cc65553f091985c2a8df7d3a3efc3c3ace741df1fd5e98447bb",
                   "af280ff791163879d7a3135fbaf7c2789447ad7a4dd95527f470b07fa451532b")
     or MD5 in ("5279c09bdabb12a3a28b0db8e838bf1b","04f5d13f78ca2ab39a8f777885c2a474",
                "0e3d8bc69fe996dbd681c01f509e8591","2a9e5e25776fff5430f2dd06335920a4",
                "3df700b3c1d0ffab386397f4e59c5b23","056ffa80af31d17e0cee037b44e0c7ef",
                "0eb0f57afd54c9733c720fbac82b754b")
  | project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, SHA256, InitiatingProcessFileName
  | extend Hunt = "Suspicious-Execution"
),
(
  // 3. Brute-force burst: many failed logons (4625) then a success (4624) — SQL/SSH entry
  SecurityEvent
  | where TimeGenerated > ago(7d)
  | where EventID == 4625
  | summarize FailCount = count(), Sources = make_set(IpAddress) by Computer, bin(TimeGenerated, 10m)
  | where FailCount >= 20
  | project TimeGenerated, Computer, FailCount, Sources
  | extend Hunt = "BruteForce-Burst"
)
| sort by TimeGenerated desc

#!/bin/bash
# hunt_q3_ssh_db_campaign.sh — IOC & artifact hunt for ShellBot/Fisieredoor (Linux)
# and Q3 2026 Windows DB-server intrusion tooling (run via SSH/WinRM or EDR live response)
# Usage: sudo ./hunt_q3_ssh_db_campaign.sh

echo "=== [1] Known-bad C2 connections (ShellBot / Windows campaign infra) ==="
for ip in 177.22.88.133 38.60.253.35; do
  ss -tnp 2>/dev/null | grep "$ip" && echo "[!] ACTIVE connection to $ip"
  grep -r "$ip" /var/log/ 2>/dev/null | head -5
done
grep -rE "microsftapiedge\.com" /var/log/ 2>/dev/null | head -5

echo "=== [2] Known malicious file hashes on disk ==="
declare -A HASHES=(
  ["5279c09bdabb12a3a28b0db8e838bf1b"]="ShellBot-sample"
  ["04f5d13f78ca2ab39a8f777885c2a474"]="Q3-Linux-payload"
  ["0e3d8bc69fe996dbd681c01f509e8591"]="Q3-Linux-payload"
  ["2a9e5e25776fff5430f2dd06335920a4"]="Q3-Linux-payload"
  ["3df700b3c1d0ffab386397f4e59c5b23"]="Q3-Linux-payload"
)
for d in /tmp /var/tmp /dev/shm /usr/lib /usr/local/bin /root; do
  [ -d "$d" ] || continue
  find "$d" -type f -maxdepth 3 2>/dev/null | while read -r f; do
    h=$(md5sum "$f" 2>/dev/null | awk '{print $1}')
    [ -n "${HASHES[$h]}" ] && echo "[!] MATCH ${HASHES[$h]}: $f ($h)"
  done
done

echo "=== [3] Masquerading payloads & suspicious binaries ==="
find / -name 'libSSL2.3.0.so' -o -name 'goauto' -o -name 'tsm' 2>/dev/null
ls -la /tmp /dev/shm /var/tmp 2>/dev/null | grep -E '^\-rwx|^.{10}x'

echo "=== [4] XHide rootkit / hidden process check ==="
# Compare /proc against ps output — mismatch suggests rootkit hiding
comm -23 <(ls /proc | grep -E '^[0-9]+$' | sort -n) \
         <(ps -eo pid | tail -n +2 | tr -d ' ' | sort -n) | while read -r pid; do
  echo "[!] PID $pid present in /proc but hidden from ps (possible XHide rootkit)"
done
lsmod 2>/dev/null | grep -iE 'xhide'

echo "=== [5] SSH brute-force evidence & persistence ==="
grep -cE 'Failed password' /var/log/auth.log /var/log/secure 2>/dev/null
awk '/Failed password/ {print $(NF-3)}' /var/log/auth.log 2>/dev/null | sort | uniq -c | sort -rn | head -10
crontab -l 2>/dev/null; ls -la /etc/cron.d/ 2>/dev/null
systemctl list-units --type=service --state=running 2>/dev/null | grep -iE 'xmrig|perl|miner'

echo "=== [6] XMRig miner / high-CPU stratum traffic ==="
ps aux | grep -iE 'xmrig|stratum|\+tcp' | grep -v grep
ss -tnp 2>/dev/null | grep -E ':3333|:4444|:5555|:7777'

echo "=== Hunt complete. Review [!] findings immediately. ==="