3 ms·

The file that yara signature refers to is probably a Ukranian "web shell" (a backdoor written in PHP that contains a file manager and simple SQL client) that is

The file that yara signature refers to is probably a Ukranian "web shell" (a backdoor written in PHP that contains a file manager and simple SQL client) that is distributed freely at http://profexer.name/pas/ http://profexer.name/pas/. Anyone can download it and check. There is also a forum thread at https://rdot.org/forum/showthread.php?t=1567 https://rdot.org/forum/showthread.php?t=1567 started by this software developer in 2011. He answers the questions from the users of his software and asks them to donate to continue development. So it is a publicly available software, not a private tool made by some hacker group for themselves. That is why other people could find it in their systems.

codedokode 10y ago
I also checked the web archive for web shell download page [1]. It turns out that the notice with the text "Made in Ukraine" appears in version on August 31, 2015 [2] but is not present at earlier versions. The forum thread [3] shows that the software has been developed at least since 2011. I also looked through the code of a web shell. The code is written to be compatible with PHP4 and has some complicated parts, like building a zip archive by bytes. It has a lot of fallback methods, for example if some PHP functions are not available or not enabled, it would try several other ways to solve the task. I didn't like the style (a lot of two-letter variables, HTML and PHP code mixed together, hard to read and maintain). It looks like it was written by one person, but it would take some time, not a project one can write in a week. I guess the motivation for developer was to prove that he could write a better web shell than others. Here is a link to a formatted source code [4] if anyone would like to see it and maybe learn some PHP4 programming tricks. [1] https://web.archive.org/web/20150601000000*/http://profexer.name/pas/download.php https://web.archive.org/web/20150601000000*/http://profexer.... [2] https://web.archive.org/web/20150831091357/http://profexer.name/pas/download.php https://web.archive.org/web/20150831091357/http://profexer.n... [3] https://rdot.org/forum/showthread.php?t=1567 https://rdot.org/forum/showthread.php?t=1567 [4] http://pastebin.com/vUpKb3FL http://pastebin.com/vUpKb3FL

codedokode 10y ago

I also checked the web archive for web shell download page [1]. It turns out that the notice with the text "Made in Ukraine" appears in version on August 31, 2015 [2] but is not present at earlier versions. The forum thread [3] shows that the software has been developed at least since 2011. I also looked through the code of a web shell. The code is written to be compatible with PHP4 and has some complicated parts, like building a zip archive by bytes. It has a lot of fallback methods, for example if some PHP functions are not available or not enabled, it would try several other ways to solve the task. I didn't like the style (a lot of two-letter variables, HTML and PHP code mixed together, hard to read and maintain). It looks like it was written by one person, but it would take some time, not a project one can write in a week. I guess the motivation for developer was to prove that he could write a better web shell than others. Here is a link to a formatted source code [4] if anyone would like to see it and maybe learn some PHP4 programming tricks. [1] https://web.archive.org/web/20150601000000*/http://profexer.name/pas/download.php https://web.archive.org/web/20150601000000*/http://profexer.... [2] https://web.archive.org/web/20150831091357/http://profexer.name/pas/download.php https://web.archive.org/web/20150831091357/http://profexer.n... [3] https://rdot.org/forum/showthread.php?t=1567 https://rdot.org/forum/showthread.php?t=1567 [4] http://pastebin.com/vUpKb3FL http://pastebin.com/vUpKb3FL