Loading malware…
1 distinct threat actor Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
Specifically, they use publicly available PHP webshells named WSO webshell and c99shell.
10 distinct techniques documented for this family, organized by ATT&CK tactic.
it is a PHP backdoor that provides a lot of functionality, for example: run shell commands
PHP/c99shell or simply c99shell should be well known by now - it is a PHP backdoor that provides a lot of functionality, for example: run shell commands; download/upload files from and to the server (FTP functionality); full access to all files on the hard disk; self-delete functionality.
It's heavily obfuscated as one would expect; after some deobfuscating/decoding we get:
self-delete functionality
Examples include upload and write operations such as "if(!move_uploaded_file($HTTP_POST_FILES['file_name']['tmp_name'], $dir.$fn", "BinaryStream.SaveToFile", "$fp=fopen(\"$check\",\"w+\");", and "file_put_contents($pth".
Representative strings include file-browser functionality such as "jsp File browser 1.1a", "showcode.asp?f=<%=File.Path%>", "echo \"<option value=\\\"$work_dir\\\" selected>Current Directory</option>\\n\";", and multiple upload/download/file manager forms.
full access to all files on the hard disk
download/upload files from and to the server (FTP functionality)
Examples include file-management and download functionality such as "<input title=\"Upload selected file to the current working directory\"", "<a href=\"javascript:doForm('down'", and "<input type=\"submit\" name=\"btnSubmit\" value=\"Upload\">".
The rule "backupsql_php_often_with_c99shell" contains "$ftpconnect = \"ncftpput -u $ftp_user_name -p $ftp_user_pass ...\"".
12 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.