Backdoor.ASP.WEBSHELL.X

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It executes commands from a remote malicious user, effectively compromising the affected system.

Arrival Details

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Backdoor Routine

This Backdoor executes the following commands from a remote malicious user:

• Execute Arbitrary commands
• Execute SQL commands
• Browse files and directories on the web server.
• Upload files to the server.
• Download files from the server.
• Create new files and directories.
• Edit existing files.
• Delete files and directories.
• Change file attributes (read-only, hidden, system, archive).

Information Theft

This Backdoor gathers the following data:

• Server IP address
• Machine name
• Network name
• Running user's name
• Operating system version
• Server uptime and current time
• IIS (web server) version
• HTTPS status
• Request paths
• Server port
• Session ID

Other Details

This Backdoor does the following:

• It receives arbitrary commands passed through its request parameter.
• It requires login credential to access its functionalities.
• It navigates to the specified website when the 'lake' hyperlink is clicked.
  • http://{BLOCKED}2.0x54.org