Backdoor.ASP.WEBSHELL.X

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Führt Befehle eines externen, böswilligen Benutzers aus, wodurch das betroffene System gefährdet wird.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Backdoor-Routine

Führt die folgenden Befehle eines externen, böswilligen Benutzers aus:

• Execute Arbitrary commands
• Execute SQL commands
• Browse files and directories on the web server.
• Upload files to the server.
• Download files from the server.
• Create new files and directories.
• Edit existing files.
• Delete files and directories.
• Change file attributes (read-only, hidden, system, archive).

Datendiebstahl

Folgende Daten werden gesammelt:

• Server IP address
• Machine name
• Network name
• Running user's name
• Operating system version
• Server uptime and current time
• IIS (web server) version
• HTTPS status
• Request paths
• Server port
• Session ID

Andere Details

Es macht Folgendes:

• It receives arbitrary commands passed through its request parameter.
• It requires login credential to access its functionalities.
• It navigates to the specified website when the 'lake' hyperlink is clicked.
  • http://{BLOCKED}2.0x54.org