P.A.S. Webshell

Malware & Tools · P.A.S. Webshell

· MalwareS0598 · Zararlı Yazılım

Type

malware

Techniques

Used By

2 groups

Platforms

Linux, Windows

Description

P.A.S. Webshell is a publicly available multifunctional PHP webshell in use since at least 2016 that provides remote access and execution on target web servers.(Citation: ANSSI Sandworm January 2021)

Tactic Coverage

discovery (4)stealth (3)collection (2)command and control (2)execution (1)credential access (1)defense impairment (1)persistence (1)

Used By (2 groups)

G1003Ember BearUNC2589, Bleeding Bear G0034Sandworm TeamELECTRUM, Telebots

Techniques (15)

T1005Data from Local System

collection

T1027Obfuscated Files or Information

stealth

T1046Network Service Discovery

discovery

T1059Command and Scripting Interpreter

execution

T1070.004File Deletion

stealth

T1071.001Web Protocols

command and control

T1083File and Directory Discovery

References

https://attack.mitre.org/software/S0598 https://www.cert.ssi.gouv.fr/uploads/CERTFR-2021-CTI-005.pdf https://us-cert.cisa.gov/sites/default/files/publications/AR-17-20045_Enhanced_Analysis_of_GRIZZLY_STEPPE_Activity.pdf