S0598 P.A.S. Webshell

malwareEnterprise

platformsLinux · Windows

also known asP.A.S. Webshell · Fobushell

P.A.S. Webshell is a publicly available multifunctional PHP webshell in use since at least 2016 that provides remote access and execution on target web servers.

techniques used (15)

ATT&CK techniques this enables or maps to.

T1005Data from Local System
T1027Obfuscated Files or Information
T1046Network Service Discovery
T1059Command and Scripting Interpreter
T1070.004File Deletion
T1071.001Web Protocols
T1083File and Directory Discovery
T1087.001Local Account
T1105Ingress Tool Transfer
T1110.001Password Guessing
T1140Deobfuscate/Decode Files or Information
T1213.006Databases
T1222.002Linux and Mac Permissions
T1505.003Web Shell
T1518Software Discovery

used by groups (2)

Threat groups associated with this.

G1003Ember Bear
G0034Sandworm Team

source

Where this definition is published.

view on ATT&CK

scry

Software like this carries known vulnerabilities once it is exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan