Shelby Propose Change

According to Elastic, SHELBY is a .NET malware family consisting of a loader (SHELBYLOADER) and a backdoor (SHELBYC2), both obfuscated with Obfuscar, which uses GitHub for command and control by sending crafted requests to the GitHub API with a personal access token embedded in the binary. The loader is side-loaded by a benign .NET executable, runs a series of sandbox and virtual machine checks, establishes persistence through a registry Run key and registers the victim by committing system information and the check results to a private repository. Only after the operator has validated the infection does it receive a value, from a repository file or in a variant through a sequence of DNS queries, from which it derives an AES key to decrypt the backdoor and load it reflectively into memory. The backdoor keeps a heartbeat file in the repository, polls for victim-specific or broadcast commands, and supports file download and upload, archive extraction, reflective loading of further AES-encrypted .NET assemblies and execution of arbitrary PowerShell commands.

References

There is no Yara-Signature yet.