GIF cloaked webshell with 2/55 detection ratio VT https://www.virustotal.com/en/file/0da7b30ee71524a2b217eea554fba6795d65617797a3c2d2f224764040d90de5/analysis/ … Code http://pastebin.com/cXNJFh97 pic.twitter.com/ZRdtVO42zd
-
@bartblaze it is, yes - I see between 2-5 new/different web shells of this type per day (detection rates range from ~2 to ~20/55)
@Cyb3rOps Interesting. Do you see an influx since 2016 or has it been more or less the same (since 2015)? Also, % of different webshells?
-
-
@bartblaze Trend is: - increase in variety - completely encoded e.g. <$php eval(base64_decode(... - smaller size - fake magic headers -
@Cyb3rOps@bartblaze Have you been collecting a larger catalog of samples? Dump it anywhere? - Show replies
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.