TF-MAL-php.shin_webshell
📛 Threat Title
Malware family: php.shin_webshell
Description
ThreatFox malware family `php.shin_webshell`.
Indicators of Compromise (0)
No indicators of compromise on this threat.
References (1)
- ThreatFox: IOCs for this family ThreatFox Malwares
Remediations (10)
-
web:attack.mitre.org
Adversaries may backdoor web servers with web shells to establish persistent access to systems. A Web shell is a Web script that is placed on an openly accessible Web server to allow an adversary to access the Web server as a gateway into a network. A Web shell may provide a set of functions to execute or a command-line interface on the system that hosts the Web server. [1] In addition to a ...
-
web:blog.sucuri.net
What is a web shell? Learn about the most common types, along with examples. We explain how shells work, what they do, and how to protect your site and clean up this malware from a hacked server.
-
web:github.com
Real-world malware incident detected at the internship company; handled end-to-end detection, analysis, and remediation of a PHP web shell in a WordPress plugin.
-
web:imtr.net
## Technical Details - Type: Malware (Webshell) - Platform: Web Servers (Likely PHP based, given the Malpedia reference ` php.shin_webshell `) - Capabilities: Remote command execution via a web interface (inferred from being a webshell). - First Seen: Date information is not present in the provided text.
-
web:malpedia.caad.fkie.fraunhofer.de
A PHP webshell that allows file system management, data exfiltration and command execution.
-
web:stackoverflow.com
Short answer: yes, you should be worried if you have a specific setup (php and webserver). You can prevent the attack by changing the setup. Long answer: the php code that you quoted is a simple webshell. It takes the parameter q and executes whatever is given to it in this parameter with the rights of the webserver. Strings like that can be embedded in various ways and in different file ...
-
web:threatfox.abuse.ch
A malware sample can be associated with only one malware family . The page below gives you an overview on indicators of compromise associated with php.shin_webshell .
-
web:www.huntress.com
A PHP webshell is a malicious script that gives attackers a back door into your web server. Once uploaded, it acts as a command-and-control interface, letting threat actors browse your file system, upload more malware , steal data, or even take over the server completely.
-
web:www.microsoft.com
Cookie-gated PHP webshells use obfuscation, php-fpm execution, and cron-based persistence to evade detection in Linux hosting environments. This post examines how this tradecraft conceals execution behind specially crafted HTTP cookies.
-
web:www.siteguarding.com
Detecting and Removing PHP Webshells: Tools, Indicators & Real Case Studies Compromised PHP sites often hide webshells - small scripts that give attackers remote command execution, file management, database access, and persistence.
AI Forensic Analysis
Only Available for Registered Users. Sign in to view.