I also checked the web archive for web shell download page [1]. It turns out that the notice with the text "Made in Ukraine" appears in version on August 31, 20

I also checked the web archive for web shell download page [1]. It turns out that the notice with the text "Made in Ukraine" appears in version on August 31, 2015 [2] but is not present at earlier versions. The forum thread [3] shows that the software has been developed at least since 2011. I also looked through the code of a web shell. The code is written to be compatible with PHP4 and has some complicated parts, like building a zip archive by bytes. It has a lot of fallback methods, for example if some PHP functions are not available or not enabled, it would try several other ways to solve the task. I didn't like the style (a lot of two-letter variables, HTML and PHP code mixed together, hard to read and maintain). It looks like it was written by one person, but it would take some time, not a project one can write in a week. I guess the motivation for developer was to prove that he could write a better web shell than others. Here is a link to a formatted source code [4] if anyone would like to see it and maybe learn some PHP4 programming tricks. [1] https://web.archive.org/web/20150601000000*/http://profexer.name/pas/download.php https://web.archive.org/web/20150601000000*/http://profexer.... [2] https://web.archive.org/web/20150831091357/http://profexer.name/pas/download.php https://web.archive.org/web/20150831091357/http://profexer.n... [3] https://rdot.org/forum/showthread.php?t=1567 https://rdot.org/forum/showthread.php?t=1567 [4] http://pastebin.com/vUpKb3FL http://pastebin.com/vUpKb3FL