shc compiles shell scripts into standalone ELF executables. While this software is not inherently malicious, it can save a lot of time if analysts are able to quickly identify samples built with this tool.

The shell script contents of shc-compiled binaries are protected with ARC4 encryption. This makes shc a popular choice for administrators attempting to mask the contents of scripts that contain secrets.

Earlier versions of shc were able to be decompiled with UnSHc: https://github.com/yanncam/UnSHc

The following Yara rule identifies samples built with shc:

rule shc
{
	meta:
		description = "Compiled with generic shell script compiler (shc)"
		reference = "https://github.com/neurobin/shc"
		decompiler = "https://github.com/yanncam/UnSHc"

	strings:
		$ = "=%lu %d"
		$ = "%lu %d%c"
		$ = "%s%s%s: %s"

	condition:
		uint32(0) == 0x464c457f and all of them
}

YARA Rules Index