Shellbot victim overlap with Emotet network infrastructure

By NTT Security Holdings

Published July 20, 2020  |  Security

Shellbot victim overlap with Emotet network infrastructure

In the fall of 2018, the security division of NTT Ltd. added botnet infrastructure detection capabilities to its Managed Security Services (MSS) and threat detection services. In the initial press release, there were limited details released on how our machine learning system leverages our access to NTT Ltd.’s global network infrastructure. We own and operate one of the world's largest tier-1 IP backbone having insight into a significant portion of the global internet traffic and is consistently ranked among the top five network providers in the world.

In this blog post, we’ll explain how our threat detection analysts used netflow data captured from our global internet infrastructure to uncover overlaps of the Emotet command and control (C2) infrastructure with a previously unknown IRC botnet.

Once upon analysing Emotet traffic It was observed by threat detection analysts that 16 Emotet command and C2s speak with the IP over port TCP/65456:

Shellbot emotet traffic

A correlation search on Open-Source Intelligence (OSINT) sources uncovered the following file hosted on the same IP:


Analysing foo.txt we came to the conclusion that it is an IRC Perl bot.

The settings are: PERL bot settings

Simplifying the code above one step, we can see how the C2 IP is set, which port is used, the room to join and a list of admins which can send commands: Simplified above code

We connected to with an IRC client in order to confirm the theory that there’s an IRC service running on port 65456: Connected to IP via IRC Client

Unexpectedly the IRC server went down, and we laid the project to rest. However, in February 2020, it was once again online and, this time, with a lot of fever victims connected. One day, the admin connected and sent commands in the channel: Admin sends commands to IRC channel

As can be seen, the actor sent various commands which all involved the uninstallation of any victims still speaking with the C2. We’ll proceed with further analysis of the source code of the IRC bot.

Code similarities with Shellbot

Shellbot is an IRC bot which previously has been researched 1 2. The sample observed here stored in foo.txt has a subset of the functionalities of the Shellbot samples referenced by other researchers 3.

The bullet points over function name similarities and dissimilarities between foo.txt and the Shellbot sample 3 :

  • 26 functions with the same name
  • 17 function names only seen in Shellbot sample 3
  • Five function names only seen foo.txt
Shellbot indicator table _Function name difference table, where green indicates that the function only exists in foo.txt and red shows it only exists in Shellbot sample 3 :_

Throughout the code there are large code overlaps showing that the bot is built upon a similar code base but has been evolutionized by different actors over time. Here’s an example of a code overlap where the only difference is that the function and variable names are in Portuguese and English: Portugeuse vs English code overlap

The function name and code segment overlaps are confirmation that foo.txt is a Shellbot variant. The large availability of samples makes any attribution of the actor behind this activity unlikely.


In our backend, we’ve captured over 80 victims connecting over port 65456 to the C2. Based on OSINT data from Shodan on these victims, we attempted to find the common denominator for the likely original point of exploitation. We started by listing the used ports:

Shellbot ports used

As can be seen, the most common ports show us no surprises, with port 22 used by 81%, indicating most victims to be *nix variants. Port 80 and 443 also occur on most of the victims, with a close to even distribution of NGINX and Apache, the ones classified as http or https are products unknown to Shodan:

most common services

We also tried to group by the number of victims affected by the same CVE, at most we only observed five victims were affected by the same CVE:

most common services

It might be that the actor is using scanners which exploits multiple known vulnerabilities and/or performs password bruteforce.


We consider the overlap of victims with Emotet C2s incidental. The massive amount of exploitation attempts which occur on the internet inevitably leads to multiple actors exploiting and operating on the same machines. Nevertheless, with this research we’ve been able to add detection for a previously unknown C2 server for the protection of our customers.

In the recently released 2020 Global Threat Intelligence Report, NTT Ltd. researchers and thought leaders share statistics and trends from the previous year. A key theme in this year’s report is ‘Attacks are focusing on web applications’. Read more about how attacks towards web applications and open-source software is changing the threat landscape here.

Indicators of compromise 44f1bc205590b4f7f9436cf0321fb1c754611a6d7a3abf986a8e1511eb843e93

References: 1 2 3 Sample from [1] 331bafbf48e1ece5134bc42f4a9bd2be

We use cookies to enhance your browsing experience, serve personalized ads or content, and analyze our traffic as described in our Privacy Policy. By clicking "Accept", you consent to our use of cookies.


Customize Consent Preferences

We use cookies to help you navigate efficiently and perform certain functions. You will find detailed information about all cookies under each consent category below. The cookies that are categorized as "Necessary" are stored on your browser as they are essential for enabling the basic functionalities of the site.