TF-MAL-php.redhat_hacker
📛 Threat Title
Malware family: RedHat Hacker WebShell
Description
ThreatFox malware family `php.redhat_hacker`. Printable name: RedHat Hacker WebShell.
Indicators of Compromise (0)
No indicators of compromise on this threat.
References (1)
- ThreatFox: IOCs for this family ThreatFox Malwares
Remediations (10)
-
web:access.redhat.com
Access Red Hat's knowledge, guidance, and support through your subscription.
-
web:asec.ahnlab.com
Table 3. Data files used 2. Analysis of WebShell The attack case disclosed in January 2025 also used the RedHat Hacker webshell , similar to the case disclosed in May 2024, and it was installed under the name 'function2.asp.' In the previous case, the RedHat Hacker web shell used the same password, '1234qwer,' as a report published by HvS-Consulting AG in the past. However, the web ...
-
web:attack.mitre.org
Adversaries may backdoor web servers with web shells to establish persistent access to systems. A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to access the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server. [1] In addition to a ...
-
web:blackswan-cybersecurity.com
Figure 1. RedHat Hacker web shell These web shells employ advanced obfuscation techniques, making them difficult to detect and analyze. A key feature of their malicious scripts includes encryption mechanisms that verify initialization packets and obscure critical command execution paths. This increasing level of sophistication highlights the persistent and adaptive nature of the Lazarus Group ...
-
web:blog.sucuri.net
What is a web shell? Learn about the most common types, along with examples. We explain how shells work, what they do, and how to protect your site and clean up this malware from a hacked server.
-
web:fedtechmagazine.com
Inside a Webshell Attack CISA notified agencies in January 2024 that vulnerabilities in two widely used VPN and network access control solutions could be exploited to implant web shells with backdoor access, enabling attackers to move laterally in the network to exfiltrate data or execute malware .
-
web:github.com
Guidance for mitigation web shells. #nsacyber. Contribute to nsacyber/Mitigating-Web-Shells development by creating an account on GitHub.
-
web:malpedia.caad.fkie.fraunhofer.de
Details for the RedHat Hacker WebShell malware family including references, samples and yara signatures.
-
web:undercodetesting.com
Webshell attacks remain a persistent threat to web servers, particularly those running Linux without endpoint detection (EDR) or antivirus (AV) protection. Attackers often disguise malicious scripts as legitimate files, such as in the recent SAP Visual Composer exploitation where a GitHub-sourced webshell was hidden within an SAP installation path.
-
web:www.siteguarding.com
This guide walks you through how webshells stick around, IOCs to scan for, concrete commands/YARA patterns to detect them, and a step-by-step cleanup methodology you can follow (or hand to your incident responder). Primary keywords: remove PHP webshell , webshell removal service, php backdoor removal CTA: Free webshell scan + emergency cleanup ...
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.