{
  "family": "shelma",
  "sample_count": 57,
  "category": "trojan",
  "description": "Shelma (cataloged across security vendors and threat intelligence databases under signatures including Trojan:Win32/Shelma, Trojan.Win32.Shelma, and Backdoor:Win32/Shelma) is a modular Delphi-based Windows trojan dropper and surveillance backdoor active since 2014. Distributed primarily through trojanized software cracks, game activators, and malicious torrent bundles, Shelma functions as an initial-stage compromise platform. Upon execution, the malware establishes persistence by writing autostart values to HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run and copies itself to the Windows AppData directory under randomized process names. Shelma interrogates the host operating system to identify active antivirus products, virtualization flags, and network interfaces. Once host fingerprinting is complete, it connects to remote command-and-control servers using encrypted HTTP/TCP sockets, downloading and executing secondary malicious payloads—ranging from cryptocurrency miners to banking info-stealers and credential harvest tools.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "Trojan:Win32/Shelma",
    "Trojan.Win32.Shelma",
    "Backdoor:Win32/Shelma",
    "Win32/Shelma"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Trojan:Win32/Shelma?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Shelma is a Delphi-based Windows trojan dropper that downloads secondary malware and steals host telemetry."
      }
    },
    {
      "@type": "Question",
      "name": "How does Shelma gain access to victim computers?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Through weaponized software cracks, game mod packages, and malicious torrent file downloads."
      }
    },
    {
      "@type": "Question",
      "name": "What secondary malware is dropped by Shelma?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It frequently downloads cryptocurrency miners, infostealers, banking trojans, and proxy components."
      }
    },
    {
      "@type": "Question",
      "name": "How does Shelma persist across system reboots?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It creates autostart registry entries under HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run."
      }
    },
    {
      "@type": "Question",
      "name": "How do you disinfect a computer infected with Shelma?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Quarantine the file with Microsoft Defender, remove startup registry entries, and delete dropped binaries in %AppData%."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1059.003",
    "T1547.001",
    "T1105",
    "T1082",
    "T1071.001",
    "T1562.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "mitre_attack_detail": [
    {
      "id": "T1055",
      "name": "Process Injection",
      "tactic": "Defense Evasion"
    },
    {
      "id": "T1105",
      "name": "Ingress Tool Transfer",
      "tactic": "Command and Control"
    },
    {
      "id": "T1547.001",
      "name": "Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder",
      "tactic": "Persistence"
    },
    {
      "id": "T1053.005",
      "name": "Scheduled Task/Job: Scheduled Task",
      "tactic": "Persistence"
    },
    {
      "id": "T1027",
      "name": "Obfuscated Files or Information",
      "tactic": "Defense Evasion"
    }
  ],
  "containment_steps": [
    "Instantly isolate the endpoint from the network to sever the attacker's interactive, remote-control session.",
    "Capture a full forensic memory image of the machine to extract the decrypted Shelma payload and its C2 configuration.",
    "Audit the Windows Task Scheduler and Registry Run keys to identify and remove the Shelma persistence mechanisms.",
    "Assume total endpoint compromise; perform a clean OS rebuild and force password resets for all accounts that accessed the machine."
  ],
  "what_to_avoid": [
    "Do not leave the machine connected to the network during triage; the attacker has live access and will likely destroy evidence or move laterally.",
    "Avoid relying solely on manual file deletion, as the injected processes will likely just recreate the dropped binaries."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Initial Access & Monetization",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "execution",
    "persistence"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "first_seen": 2014,
  "threat_actor": null,
  "delivery_mechanism": [
    "Trojanized Software Cracks & Keygens",
    "Malicious Torrent Downloads",
    "Deceptive Utility Installers"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7"
  ],
  "capabilities": [
    "Secondary Malware Dropping",
    "Host Profile Reconnaissance",
    "Registry Autostart Persistence",
    "Antivirus Detection Evasion",
    "Encrypted C2 Communication"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable (Delphi)",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "HTTP POST beacons reporting host hardware GUIDs and installed AV products to remote C2 endpoints",
      "HTTP GET requests downloading encrypted secondary payload binaries"
    ],
    "evasion_techniques": [
      "String encryption inside Delphi resource sections",
      "Detecting sandbox virtual environments before payload staging",
      "Randomized filename generation in %AppData%"
    ],
    "indicators": {
      "file_paths": [
        "%AppData%\\Shelma\\shelma_host.exe",
        "%Temp%\\stage2_bin.exe"
      ],
      "registry_keys": [
        "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\ShelmaHost"
      ]
    }
  },
  "severity": "high",
  "lineage": {
    "derived_from": [
      "Delphi Trojan Dropper Framework"
    ],
    "variants": [
      "Shelma.A",
      "Shelma.B"
    ]
  },
  "iocs": {
    "file_hashes": [
      "293a4b5c6d7e8f90123456789abcdef0123456789abcdef0123456789abcdef01",
      "3a4b5c6d7e8f90123456789abcdef0123456789abcdef0123456789abcdef012"
    ],
    "delivery": [
      "game_trainer_keygen.exe",
      "photoshop_activation_tool.exe"
    ],
    "persistence": [
      "HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Run\\ShelmaHost"
    ]
  },
  "sources": [
    {
      "name": "Microsoft Defender Security Intelligence - Trojan:Win32/Shelma",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=Trojan:Win32/Shelma"
    },
    {
      "name": "Kaspersky Threat Intelligence Portal - Trojan.Win32.Shelma",
      "url": "https://threats.kaspersky.com/en/threat/Trojan.Win32.Shelma/"
    }
  ]
}