TF-MAL-php.glutton
📛 Threat Title
Malware family: Glutton
Description
ThreatFox malware family `php.glutton`. Printable name: Glutton.
Indicators of Compromise (1)
Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.
domain
php.glutton
VT: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/php.glutton
IOC database
- Type
- domain
- Value
php.glutton- First seen
- Last seen
- Attached to this threat
- Appears in
- 1 threat
- Description
- Extracted from Threat TF-MAL-php.glutton
Threat Hunt — feed corroboration
Not present in any configured threat-intel feed.
Details From VirusTotal
VirusTotal: VT base fetch failed: HTTPError: 429 Client Error: Too Many Requests for url: https://www.virustotal.com/api/v3/domains/php.glutton
References (1)
- ThreatFox: IOCs for this family ThreatFox Malwares
Remediations (10)
-
web:blog.xlab.qianxin.com
To mitigate the threat posed by Glutton , we recommend that system administrators take the following steps to identify and neutralize potential infections: Inspect all PHP files for signs of l0ader_shell. Remove malicious processes, including the Winnti backdoor process and the PHP backdoor process.
-
web:clickcontrol.com
A newly discovered PHP backdoor named Glutton , potentially linked to Chinese APT41 group, targets systems across multiple countries including China, US, and others. The malware features comprehensive…
-
web:cyberpress.org
A new PHP-based backdoor, Glutton , was deployed by the Winnti group, which delivered via a malicious PHP file, injects code into popular PHP frameworks to install a Winnti backdoor. While the Winnti backdoor is a signature tool of the group, Glutton's simplistic design and weak security measures suggest potential limitations in the attack's sophistication. Glutton , a sophisticated malware ...
-
web:cybersecsentinel.com
Threat Group: Winnti (APT41) Threat Type: PHP-Based Backdoor Malware Exploited Vulnerabilities: Known vulnerabilities in PHP frameworks (Laravel, ThinkPHP) Malware Used: Glutton , ELF-based Winnti backdoor Threat Score: High (8.5/10) - Due to its advanced modular design, stealth capabilities, and targeting of both legitimate and cybercriminal systems. Last Threat Observation: December
-
web:cybersecurefox.com
Security researchers at QAX XLab have uncovered a sophisticated modular PHP backdoor named Glutton , attributed to the notorious Advanced Persistent Threat (APT) group Winnti (also known as APT41). This newly identified malware demonstrates advanced capabilities in targeting organizations across China and the United States, while employing an unusual strategy of compromising other cybercriminal ...
-
web:imtr.net
Analysis Summary # Tool/Technique: Glutton ## Overview Glutton is a newly identified, highly evasive PHP web shell (backdoor) designed to evade modern detection methods. It is reportedly being used by actors associated with the Winnti operation group, aiming to establish persistent access via compromised web servers.
-
web:malpedia.caad.fkie.fraunhofer.de
According to Xlab, Glutton is a modular PHP fileless attack framework, capable of data exfiltration and running backdoors.
-
web:rewterz.com
Analysis Summary 'Glutton' is a new PHP backdoor that the Chinese threat group APT41 is utilizing to attack both Chinese and American corporations, as well as other cybercriminals. The new PHP malware was found in late April 2024 by researchers but there is proof that it was deployed in December 2023 together with other files. Although Glutton is a sophisticated backdoor, researchers note that ...
-
web:thehackernews.com
Glutton malware by APT41 targets PHP systems globally, exploiting frameworks like Laravel and ThinkPHP, with unencrypted C2 communications.
-
web:www.techshotsapp.com
A new PHP-based backdoor, dubbed Glutton , has been identified targeting popular frameworks like Laravel and ThinkPHP. Attributed to the Chinese Winnti group, Glutton infiltrates systems by exploiting vulnerabilities and brute-force attacks, enabling data theft and code injection. Notably, it also targets cybercriminals by compromising their tools, reflecting a 'no honor among thieves' scenario.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.