ctrlINT What the industry said about every indicator, with the quote

BehinderMalware

A webshell for multiple web languages (asp/aspx, jsp/jspx, php), openly distributed through Github.From MISP Galaxy

Last reported 3 months ago, by Volexity3 reports

ATT&CK techniques

6 of 57 · each with the sentence it comes from
  1. T1505.003Web Shell

    “Server Software Component: Web Shell (T1505.003)”

    Group-IBVendor
  2. T1053.005Scheduled Task

    “Scheduled Task/Job: Scheduled Task T1053.005”

    Group-IBVendor
  3. T1003OS Credential Dumping

    “OS Credential Dumping (T1003)”

    Group-IBVendor
  4. T1003.007Proc Filesystem

    “… of the workplace.startup.CommandStartup process is located by enumerating the command-line pseudo-file for each PID listed in the /proc filesystem.”

    VolexityVendor
  5. T1003.008/etc/passwd and /etc/shadow

    “OS Credential Dumping: /etc/passwd and /etc/shadow (T1003.008)”

    Group-IBVendor
  6. T1005Data from Local System

    “Data from Local System (T1005)”

    Group-IBVendor

Reports per month

last 12 months

October so far (hatched). Counted by report, not by story.

What the reports say

3 reports, newest first · the exact sentence from each

  1. “The payload is a custom Java webshell that operates similarly to the open-source webshell Behinder.”

    VolexityVendor
    Proxying to Compromise: SonicWall Secure Mobile Access 0-day Exploitation

  2. “Use of Godzilla, Behinder webshells.”

    Group-IBVendor
    ShadowSilk: A Cross-Border Binary Union for Data Exfiltration

  3. “The string “rebeyond” refers to the developer of the Behinder web shell framework.”

    Elastic Security LabsVendor
    REF2924: how to maintain persistence as an (advanced?) threat

Indicators in its reports

named in the reports above
Copy these 20 indicators · defanged

Thanks — we review every report.

Report a wrong match
What is wrong with Behinder here?
No account needed. We do not store your IP address.