Godzilla WebshellMalware
Last reported 13 months ago, by Group-IB1 report
ATT&CK techniques
6 of 55 · each with the sentence it comes from- T1003OS Credential Dumping
“OS Credential Dumping (T1003)”
- T1003.008/etc/passwd and /etc/shadow
“OS Credential Dumping: /etc/passwd and /etc/shadow (T1003.008)”
- T1005Data from Local System
“Data from Local System (T1005)”
- T1007System Service Discovery
“System Service Discovery (T1007)”
- T1008Fallback Channels
“Fallback Channels (T1008)”
- T1016.001Internet Connection Discovery
“System Network Configuration Discovery: Internet Connection Discovery (T1016.001)”
What the reports say
1 report, newest first · the exact sentence from each-
ShadowSilk: A Cross-Border Binary Union for Data Exfiltration“A screenshot of the attacker’s machine, displaying the Godzilla Webshell.”
Indicators in its reports
named in the reports above- hxxps://api.telegram[.]org/botin 1 report
Copy this indicator · defanged
Thanks — we review every report.