P.A.S. Webshell — Malware Profile

P.A.S. Webshell is a publicly available multifunctional PHP webshell in use since at least 2016 that provides remote access and execution on target web servers.

MITRE ATT&CK techniques (15)

• T1005 Data from Local System
• T1027 Obfuscated Files or Information
• T1046 Network Service Discovery
• T1059 Command and Scripting Interpreter
• T1070.004 File Deletion
• T1071.001 Web Protocols
• T1083 File and Directory Discovery
• T1087.001 Local Account
• T1105 Ingress Tool Transfer
• T1110.001 Password Guessing
• T1140 Deobfuscate/Decode Files or Information
• T1213.006 Databases
• T1222.002 Linux and Mac Permissions
• T1505.003 Web Shell
• T1518 Software Discovery

Attributed threat actors

• Sandworm Team
• Ember Bear

Read the full analysis on IntelFusions