Куда я попал?
SECURITM это SGRC система, ? автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

P.A.S. Webshell

P.A.S. Webshell is a publicly available multifunctional PHP webshell in use since at least 2016 that provides remote access and execution on target web servers.(Citation: ANSSI Sandworm January 2021)
ID: S0598
Associated Software: Fobushell
Type: MALWARE
Platforms: Windows
Version: 1.0
Created: 13 Apr 2021
Last Modified: 13 Apr 2021

Associated Software Descriptions

Name Description
Fobushell (Citation: NCCIC AR-17-20045 February 2017)

Techniques Used

Domain ID Name Use
Enterprise T1087 .001 Account Discovery: Local Account

P.A.S. Webshell can display the /etc/passwd file on a compromised host.(Citation: ANSSI Sandworm January 2021)

Enterprise T1071 .001 Application Layer Protocol: Web Protocols

P.A.S. Webshell can issue commands via HTTP POST.(Citation: ANSSI Sandworm January 2021)

Enterprise T1110 .001 Brute Force: Password Guessing

P.A.S. Webshell can use predefined users and passwords to execute brute force attacks against SSH, FTP, POP3, MySQL, MSSQL, and PostgreSQL services.(Citation: ANSSI Sandworm January 2021)

Enterprise T1222 .002 File and Directory Permissions Modification: Linux and Mac File and Directory Permissions Modification

P.A.S. Webshell has the ability to modify file permissions.(Citation: ANSSI Sandworm January 2021)

Enterprise T1070 .004 Indicator Removal: File Deletion

P.A.S. Webshell can delete scripts from a subdirectory of /tmp after they are run.(Citation: ANSSI Sandworm January 2021)

Enterprise T1505 .003 Server Software Component: Web Shell

P.A.S. Webshell can gain remote access and execution on target web servers.(Citation: ANSSI Sandworm January 2021)

Groups That Use This Software

ID Name References
G0034 Sandworm Team

(Citation: ANSSI Sandworm January 2021)