70036355-98-20180206231819.webstarterz.com · 10806102017.zip

/

Thailand · GMO-Z com NetDesign Holdings Co., Ltd.

Yara telnet_cgi From Florian Roth by Neo23x0 Yara BRG + customization by Stefan -dfate- Molls

Yara cgi_python_py From Florian Roth by Neo23x0 Yara BRG + customization by Stefan -dfate- Molls

Yara _GFS_web_shell_ver_3_1_7___PRiV8_php_nshell_php_php_gfs_sh_php_php From Florian Roth by Neo23x0 Yara BRG + customization by Stefan -dfate- Molls

Yara WEBSHELL_PHP_Generic From Florian Roth by Arnim Rupp (https://github.com/ruppde)

Yara PHANTASMA_php From Florian Roth by Neo23x0 Yara BRG + customization by Stefan -dfate- Molls

Yara webshell_c99_locus7s_c99_w4cking_xxx From Florian Roth by Florian Roth (Nextron Systems)

www.70036355-98-20180206231819.webstarterz.com · 10806102017.zip

/

Thailand · GMO-Z com NetDesign Holdings Co., Ltd.

Yara telnet_cgi From Florian Roth by Neo23x0 Yara BRG + customization by Stefan -dfate- Molls

Yara cgi_python_py From Florian Roth by Neo23x0 Yara BRG + customization by Stefan -dfate- Molls

Yara _GFS_web_shell_ver_3_1_7___PRiV8_php_nshell_php_php_gfs_sh_php_php From Florian Roth by Neo23x0 Yara BRG + customization by Stefan -dfate- Molls

Yara WEBSHELL_PHP_Generic From Florian Roth by Arnim Rupp (https://github.com/ruppde)

Yara PHANTASMA_php From Florian Roth by Neo23x0 Yara BRG + customization by Stefan -dfate- Molls

Yara webshell_c99_locus7s_c99_w4cking_xxx From Florian Roth by Florian Roth (Nextron Systems)

www.tremplan.de · web583.zip

/

Germany · Hetzner Online GmbH

Yara telnet_cgi From Florian Roth by Neo23x0 Yara BRG + customization by Stefan -dfate- Molls

Yara FeliksPack3___PHP_Shells_ssh From Florian Roth by Florian Roth (Nextron Systems)

Yara WEBSHELL_PHP_Generic From Florian Roth by Arnim Rupp (https://github.com/ruppde)

Download archived sample

The password is "infected"

www.tremplan.de · web583.zip

/

Germany · Hetzner Online GmbH

Yara telnet_cgi From Florian Roth by Neo23x0 Yara BRG + customization by Stefan -dfate- Molls

Yara FeliksPack3___PHP_Shells_ssh From Florian Roth by Florian Roth (Nextron Systems)

Yara WEBSHELL_PHP_Generic From Florian Roth by Arnim Rupp (https://github.com/ruppde)

Download archived sample

The password is "infected"

tremplan.de · web583.zip

/

Germany · Hetzner Online GmbH

Yara telnet_cgi From Florian Roth by Neo23x0 Yara BRG + customization by Stefan -dfate- Molls

Yara FeliksPack3___PHP_Shells_ssh From Florian Roth by Florian Roth (Nextron Systems)

Yara WEBSHELL_PHP_Generic From Florian Roth by Arnim Rupp (https://github.com/ruppde)

Download archived sample

The password is "infected"

72761581-26-20200618220241.webstarterz.com · getawaycationandorganizer.com-website-before-fix-malware.zip

/

Thailand · GMO-Z com NetDesign Holdings Co., Ltd.

Yara WEBSHELL_PHP_Generic From Florian Roth by Arnim Rupp (https://github.com/ruppde)

Yara PHP_Webshell_1_Feb17 From Florian Roth by Florian Roth (Nextron Systems)

www.72761581-26-20200618220241.webstarterz.com · getawaycationandorganizer.com-website-before-fix-malware.zip

/

Thailand · GMO-Z com NetDesign Holdings Co., Ltd.

Yara WEBSHELL_PHP_Generic From Florian Roth by Arnim Rupp (https://github.com/ruppde)

Yara PHP_Webshell_1_Feb17 From Florian Roth by Florian Roth (Nextron Systems)

mail.72761581-26-20200618220241.webstarterz.com · getawaycationandorganizer.com-website-before-fix-malware.zip

/

Thailand · GMO-Z com NetDesign Holdings Co., Ltd.

Yara WEBSHELL_PHP_Generic From Florian Roth by Arnim Rupp (https://github.com/ruppde)

Yara PHP_Webshell_1_Feb17 From Florian Roth by Florian Roth (Nextron Systems)

campusgiq.com · copia_06_12_22-humanizar.edu.co.zip

/

United States · UNIFIEDLAYER-AS-1

Yara WEBSHELL_PHP_Generic From Florian Roth by Arnim Rupp (https://github.com/ruppde)

Yara GIFCloaked_Webshell_A From Florian Roth by Florian Roth (Nextron Systems)

Yara WEBSHELL_PHP_Generic_Callback From Florian Roth by Arnim Rupp (https://github.com/ruppde)

campusgiq.com · copia_06_12_22-humanizar.edu.co.zip

/

United States · UNIFIEDLAYER-AS-1

Yara WEBSHELL_PHP_Generic From Florian Roth by Arnim Rupp (https://github.com/ruppde)

Yara GIFCloaked_Webshell_A From Florian Roth by Florian Roth (Nextron Systems)

Yara WEBSHELL_PHP_Generic_Callback From Florian Roth by Arnim Rupp (https://github.com/ruppde)

www.tremplan.de · web583.zip

/

Germany · Hetzner Online GmbH

Yara telnet_cgi From Florian Roth by Neo23x0 Yara BRG + customization by Stefan -dfate- Molls

Yara FeliksPack3___PHP_Shells_ssh From Florian Roth by Florian Roth (Nextron Systems)

Yara WEBSHELL_PHP_Generic From Florian Roth by Arnim Rupp (https://github.com/ruppde)

Download archived sample

The password is "infected"

parrot.elhacker.net · payloadsallthethings_2.1.orig.tar.gz

/pool/main/p/payloadsallthethings/

Spain · Adamo Telecom Iberia S.A.

Yara SUSP_PowerShell_Caret_Obfuscation_2 From Florian Roth by Florian Roth (Nextron Systems)

Yara Mimikatz_Memory_Rule_1 From Florian Roth by Florian Roth

Yara SUSP_Netsh_PortProxy_Command From Florian Roth by Florian Roth (Nextron Systems)

Yara Disable_Defender From AbuseCH by iam-py-test

Yara SUSP_EXPL_POC_VMWare_Workspace_ONE_CVE_2022_22954_Apr22 From Florian Roth by Florian Roth

Yara WEBSHELL_PHP_Generic From Florian Roth by Arnim Rupp (https://github.com/ruppde)

Download archived sample

The password is "infected"

mail.72761581-26-20200618220241.webstarterz.com · getawaycationandorganizer.com-website-before-fix-malware.zip

/

Thailand · GMO-Z com NetDesign Holdings Co., Ltd.

Yara WEBSHELL_PHP_Generic From Florian Roth by Arnim Rupp (https://github.com/ruppde)

Yara PHP_Webshell_1_Feb17 From Florian Roth by Florian Roth (Nextron Systems)

72761581-26-20200618220241.webstarterz.com · getawaycationandorganizer.com-website-before-fix-malware.zip

/

Thailand · GMO-Z com NetDesign Holdings Co., Ltd.

Yara WEBSHELL_PHP_Generic From Florian Roth by Arnim Rupp (https://github.com/ruppde)

Yara PHP_Webshell_1_Feb17 From Florian Roth by Florian Roth (Nextron Systems)

72761581-26-20200618220241.webstarterz.com · getawaycationandorganizer.com-website-before-fix-malware.zip

/

Thailand · GMO-Z com NetDesign Holdings Co., Ltd.

Yara WEBSHELL_PHP_Generic From Florian Roth by Arnim Rupp (https://github.com/ruppde)

Yara PHP_Webshell_1_Feb17 From Florian Roth by Florian Roth (Nextron Systems)

www.72761581-26-20200618220241.webstarterz.com · getawaycationandorganizer.com-website-before-fix-malware.zip

/

Thailand · GMO-Z com NetDesign Holdings Co., Ltd.

Yara WEBSHELL_PHP_Generic From Florian Roth by Arnim Rupp (https://github.com/ruppde)

Yara PHP_Webshell_1_Feb17 From Florian Roth by Florian Roth (Nextron Systems)

campusgiq.com · copia_06_12_22-humanizar.edu.co.zip

/

United States · UNIFIEDLAYER-AS-1

Yara WEBSHELL_PHP_Generic From Florian Roth by Arnim Rupp (https://github.com/ruppde)

Yara GIFCloaked_Webshell_A From Florian Roth by Florian Roth (Nextron Systems)

Yara WEBSHELL_PHP_Generic_Callback From Florian Roth by Arnim Rupp (https://github.com/ruppde)

www.demo8.bootech.com.tr · FTP.zip

/

Türkiye · Verimek Telekomunikasyon San Ve Tic. Ltd. Sti.

Yara WEBSHELL_PHP_Generic From Florian Roth by Arnim Rupp (https://github.com/ruppde)

Download archived sample

The password is "infected"

pos.posinbangladesh.com · uywwyru87pos.zip

/

Bangladesh · Wolast Technologies

Yara GIFCloaked_Webshell_A From Florian Roth by Florian Roth (Nextron Systems)

Yara WEBSHELL_PHP_Generic From Florian Roth by Arnim Rupp (https://github.com/ruppde)

Yara webshell_asp_list From Florian Roth by Florian Roth (Nextron Systems)

Yara WEBSHELL_PHP_Generic_Callback From Florian Roth by Arnim Rupp (https://github.com/ruppde)

Yara webshell_itsec_PHPJackal_itsecteam_shell_jHn From Florian Roth by Florian Roth (Nextron Systems)

Yara WebShell_qsd_php_backdoor From Florian Roth by Florian Roth (Nextron Systems)

Yara SUSP_Base64_Encoded_Hex_Encoded_Code From Florian Roth by Florian Roth (Nextron Systems)

www.pos.posinbangladesh.com · uywwyru87pos.zip

/

Bangladesh · Wolast Technologies

Yara GIFCloaked_Webshell_A From Florian Roth by Florian Roth (Nextron Systems)

Yara WEBSHELL_PHP_Generic From Florian Roth by Arnim Rupp (https://github.com/ruppde)

Yara webshell_asp_list From Florian Roth by Florian Roth (Nextron Systems)

Yara WEBSHELL_PHP_Generic_Callback From Florian Roth by Arnim Rupp (https://github.com/ruppde)

Yara webshell_itsec_PHPJackal_itsecteam_shell_jHn From Florian Roth by Florian Roth (Nextron Systems)

Yara WebShell_qsd_php_backdoor From Florian Roth by Florian Roth (Nextron Systems)

Yara SUSP_Base64_Encoded_Hex_Encoded_Code From Florian Roth by Florian Roth (Nextron Systems)