Notification
This report is provided "as is" for informational purposes only. The Department of Homeland Security (DHS) does not provide any warranties of any kind regarding any information contained herein. The DHS does not endorse any commercial product or service referenced in this bulletin or otherwise.
This document is marked TLP:WHITE--Disclosure is not limited. Sources may use TLP:WHITE when information carries minimal or no foreseeable risk of misuse, in accordance with applicable rules and procedures for public release. Subject to standard copyright rules, TLP:WHITE information may be distributed without restriction. For more information on the Traffic Light Protocol (TLP), see http://www.cisa.gov/tlp.
Summary
Description
CISA received seven files for analysis. Six Java Server Pages (JSP) webshells and a Bourne Again SHell (bash) file. Five JSP webshell files are designed to parse inbound requests for commands for execution, download files, and upload files. One JSP webshell file contains a form with input fields that prompts the attacker to enter the command in the input box and click "run" to execute. The command output will be displayed in a JSP page. The bash file is designed to perform ldapsearch queries and store the output into a newly created directory.
Download the STIX version of this report: MAR-10400779.r1.v1.WHITE_stix, 1.3 MB
Submitted Files (7)
28b7896bf81c5bcbe63c59ee7bfce3893894d93699949f59884834077694bd52 (TasksTtt.jsp)
6dee4a1d4ac6b969b1f817e36cb5d36c5de84aa8fe512f3b6e7de80a2310caea (DatatypeConverter.jsp)
9d2a842e7a39358adc68311dcc0bc550ba375eae7513a3d4de326e948d09c245 (test.jsp)
c24ead55e58422365f034d173bb0415c16be78928b2843ef8f6f62feb15e1553 (xjhdshd.jsp)
c602db153f48ab6580e5e85925677780c3d5a483c66c392a8ab8265aa108a409 (security.jsp)
c8c1a0fae73b578480b15ff552499c271a1b49f7af2fb9fc7f8adaa4e984f614 (test2.jsp)
d335d7e3a0ac77e132e9ea839591fa81f67cd8eef136ec6586a1d6b1f29e18f1 (test.sh)
Findings
c602db153f48ab6580e5e85925677780c3d5a483c66c392a8ab8265aa108a409
Tags
trojanwebshell
Details
Name |
security.jsp |
Size |
2629 bytes |
Type |
ASCII text, with very long lines |
MD5 |
2847c3be246be1dfd49789ebbffd5553 |
SHA1 |
a1e0297b1195fad89eb500d43e860c3beae90840 |
SHA256 |
c602db153f48ab6580e5e85925677780c3d5a483c66c392a8ab8265aa108a409 |
SHA512 |
9d61f0dab4368c49055780e6db6d337d46a3b3a00eee0136456c4cf5705c8b272b96a258f23c69d62475caeddfc7dec92526caf69959f4f6b112377fa529673b |
ssdeep |
48:LO0Vh1APgh1Ey4zSTYeMvQcvQZcLeR6wpEsSMk/ijSjhAjYv:Ca1APgredtX5k6MXjSjhAjC |
Entropy |
5.158869 |
Antivirus
Adaware |
Generic.JAVA.WebShell.B.1D5257AD |
AhnLab |
WebShell/JSP.Godzilla.S1719 |
Bitdefender |
Generic.JAVA.WebShell.B.1D5257AD |
ESET |
Java/Webshell.AX trojan |
IKARUS |
Trojan.Java.Webshell |
McAfee |
JAVA/Webshell.c |
Quick Heal |
HTML.Trojan.45967 |
Sophos |
Troj/JSPRat-D |
Symantec |
Process timed out |
Trend Micro |
Backdoo.514E18B9 |
Trend Micro HouseCall |
Backdoo.514E18B9 |
YARA Rules
- rule CISA_10400779_01 : trojan webshell GODZILLA
{
meta:
Author = "CISA Code & Media Analysis"
Incident = "10400779"
Date = "2022-08-29"
Last_Modified = "20220908_1400"
Actor = "n/a"
Category = "Trojan Webshell"
Family = "GODZILLA"
Description = "Detects Godzilla webshell samples"
MD5 = "2847c3be246be1dfd49789ebbffd5553"
SHA256 = "c602db153f48ab6580e5e85925677780c3d5a483c66c392a8ab8265aa108a409"
strings:
$s0 = { 53 74 72 69 6E 67 20 78 63 }
$s1 = { 53 74 72 69 6E 67 20 70 61 73 73 }
$s2 = { 6D 64 35 28 70 61 73 73 2B 78 63 29 }
$s3 = { 43 6C 61 73 73 4C 6F 61 64 65 72 }
$s4 = { 53 65 63 72 65 74 4B 65 79 53 70 65 63 }
$s5 = { 4D 65 73 73 61 67 65 44 69 67 65 73 74 }
$s6 = { 62 61 73 65 36 34 }
$s7 = { 72 65 71 75 65 73 74 2E 67 65 74 50 61 72 61 6D 65 74 65 72 }
$s8 = { 73 65 73 73 69 6F 6E 2E 73 65 74 41 74 74 72 69 62 75 74 65 }
condition:
filesize < 10KB and all of them
}
ssdeep Matches
No matches found.
Description
This file is a JSP webshell and has also been identified as a Godzilla webshell. When the webshell is loaded, it parses the inbound request for the parameter named "pass". If the parameter is found in the request, it retrieves the value data (attack payload/command’s functional code) of the parameter and Base64 decodes it. The decoded data is decrypted a hard-coded Advanced Encryption Standard (AES) cipher. The AES decryption and encryption key is the hard-coded key value "3c6e0b8a9c15224a", which is the first 16 characters of the MD5 hash for the word "key".
The malware checks if the session used to store the decrypted data is empty. If it is empty, it stores the decrypted data in the session and uses the classloader to load the decrypted byte-code data. If it is not empty and there is an initialized payload, it will call the payload specific function. It assigns the decrypted data to a parameter and stores it into ByteArrayOutputStream and pageContext.
The content of the decrypted data will be executed to perform additional functions. The output of the command executed is AES encrypted and Base64 encoded before being sent to the Godzilla's server in an Hypertext Transfer Protocol (HTTP) response.
Screenshots
Figure 1 - This code snippet contains a class constructor (class X) to create classes of attack payloads in string format. The x function is the encryption and decryption function of AES. It uses the Java ternary conditional operator to indicate AES decryption and encryption ( 1 is encryption mode, and 2 is the decryption mode). It generates the MD5 hash value of the hard-coded password and the key.
Figure 2 - This code snippet parses inbound POST requests, decrypts its content with a hard-coded key, stores the decrypted payload in the session, executes it and returns the result of the command executed. The output is AES encrypted and Base64 encoded before being sent to the Godzilla's server in an HTTP response.
28b7896bf81c5bcbe63c59ee7bfce3893894d93699949f59884834077694bd52
Tags
utility
Details
Name |
TasksTtt.jsp |
Size |
722 bytes |
Type |
ASCII text, with very long lines |
MD5 |
36cfcfb4e6988caf8e449a7f26c92eae |
SHA1 |
b2c45a12c6ead4d9dc9902a93c2e1e45c20a16d9 |
SHA256 |
28b7896bf81c5bcbe63c59ee7bfce3893894d93699949f59884834077694bd52 |
SHA512 |
070d68dec36e0057747162842168397752576d09436c8096fa7606fe02deb810a96b2b675ff70cd60104b931701a6b0fa1e4c19381a316586890d7caa6c3fff5 |
ssdeep |
12:eew2rF79Xm8POq4PO+yMCi/wageKgWvsa0kdo8gerWjW9Wwx:DPx9W8P8PjyW/wa9Kpsa0X89rWjW9Wa |
Entropy |
5.049376 |
Antivirus
Symantec |
Unavailable (production) |
YARA Rules
- rule CISA_10400779_02 : utility ZIMBRA
{
meta:
Author = "CISA Code & Media Analysis"
Incident = "10400779"
Date = "2022-08-29"
Last_Modified = "20220908_1400"
Actor = "n/a"
Category = "Utility"
Family = "ZIMBRA"
Description = "Detects malicious JSP Zimbra samples"
MD5 = "36cfcfb4e6988caf8e449a7f26c92eae"
SHA256 = "28b7896bf81c5bcbe63c59ee7bfce3893894d93699949f59884834077694bd52"
strings:
$s0 = { 2F 62 69 6E 2F 73 68 }
$s1 = { 22 72 6D 20 2D 72 66 }
$s2 = { 2F 76 61 72 2F 74 6D 70 2F 74 6D 70 2E 6A 61 72 }
$s3 = { 74 61 72 20 63 7A 66 }
$s4 = { 61 63 63 6F 75 6E 74 73 2E 78 6D 6C }
$s5 = { 6C 6F 63 61 6C 63 6F 6E 66 69 67 2E 78 6D 6C }
$s6 = { 2E 65 78 65 63 28 63 31 }
$s7 = { 2E 65 78 65 63 28 63 32 }
$s8 = { 2E 65 78 65 63 28 63 33 }
condition:
filesize < 10KB and all of them
}
ssdeep Matches
No matches found.
Description
This file is a JSP file designed to use a shell command to remove an existing Java ARchive (jar) file "/var/tmp/tmp.jar", create a new tar archive file /var/tmp/tmp.jar", and then create a symbolic link to the jar file.
Displayed below is the shell command used to remove the file "/var/tmp/tmp.jar":
--Begin command--
"sh -c rm -rf /var/tmp/tmp.jar"
--End command--
Displayed below is the shell command used to combine and group the files below into a single archive file "/var/tmp/tmp.jar"
--Begin command--
"sh -c tar czf /var/tmp/tmp.jar /opt/zimbra/backup/accounts.xml /opt/zimbra/backup/accounts.xml.old /opt/zimbra/data/ldap/config /opt/zimbra/data/ldap/ldap* /var/log/zimbra.log /opt/zimbra/jetty_base/webapps/zimbra/public/ /opt/zimbra/jetty_base/webapps/zimbraAdmin/public/ /tmp/ldap/ /etc/hosts /etc/passwd /opt/zimbra/conf/localconfig.xml"
--End command--
Displayed below is the shell command used to create a symbolic link in "/opt/zimbra/jetty_base/webapps/zimbra/public/tmp.jar" to the file "/var/tmp/tmp.jar":
--Begin command--
"sh -c ln -s /var/tmp/tmp.jar /opt/zimbra/jetty_base/webapps/zimbra/public/tmp.jar"
--End command--
Screenshots
Figure 3 - The contents of the JSP file.
c8c1a0fae73b578480b15ff552499c271a1b49f7af2fb9fc7f8adaa4e984f614
Tags
backdoortrojanwebshell
Details
Name |
test2.jsp |
Size |
377 bytes |
Type |
ASCII text, with CRLF line terminators |
MD5 |
0751fbc32ada4ded129a15a0d1ea0459 |
SHA1 |
cd2e32eab50da45f747a02cacaa8f91da8d3da98 |
SHA256 |
c8c1a0fae73b578480b15ff552499c271a1b49f7af2fb9fc7f8adaa4e984f614 |
SHA512 |
753da768406ccbad90bbd186778c43b443d7357ba5a4c623dbbac24207fc00331c007dcda2df4cd16466839e987ec059cda8a2d64ec4ad3296c58f06bc6d9f58 |
ssdeep |
6:NNoONRzP2Mnp+eGFsICBAeiW2Mnhsj/dZdRAlFrkQJNtxcFERwzQ:QOTPTph1IdaThsj7dRY9Jws |
Entropy |
4.687617 |
Antivirus
Adaware |
Generic.ASP.WebShell.AF.963D0B0D |
AhnLab |
WebShell/JSP.Generic.S1578 |
Antiy |
Trojan[Backdoor]/PHP.Webshell.a |
Bitdefender |
Generic.ASP.WebShell.AF.963D0B0D |
Cyren |
ABRisk.PEQJ-6 |
ESET |
Java/Webshell.L trojan |
McAfee |
JAVA/Webshell.f |
Sophos |
Troj/WebShel-BJ |
YARA Rules
- rule CISA_10400779_03 : trojan webshell backdoor
{
meta:
Author = "CISA Code & Media Analysis"
Incident = "10400779"
Date = "2022-08-29"
Last_Modified = "20220908_1400"
Actor = "n/a"
Category = "Trojan Webshell Backdoor"
Family = "n/a"
Description = "Detects malicious password protected JSP webshell samples"
MD5 = "0751fbc32ada4ded129a15a0d1ea0459"
SHA256 = "c8c1a0fae73b578480b15ff552499c271a1b49f7af2fb9fc7f8adaa4e984f614"
strings:
$s0 = { 2E 65 71 75 61 6C 73 }
$s1 = { 67 65 74 50 61 72 61 6D 65 74 65 72 28 22 70 77 64 22 29 }
$s2 = { 2E 65 78 65 63 28 72 65 71 75 65 73 74 2E 67 65 74 50 61 72 61 6D 65 74 65 72 }
$s3 = { 2E 67 65 74 49 6E 70 75 74 53 74 72 65 61 6D }
$s4 = { 6F 75 74 2E 70 72 69 6E 74 28 }
$s5 = { 3C 70 72 65 3E }
$s6 = { 3C 2F 70 72 65 3E }
condition:
filesize < 10KB and all of them
}
ssdeep Matches
No matches found.
Description
This file is a password protected JSP webshell designed to retrieve and execute certain parameters from the attacker. When the attacker makes a request to the malicious JSP file along with certain parameters, it checks if the password supplied by the attacker through the "pwd" parameter is equals to "123456". If the password is correct, it executes the command supplied by the attacker through the "i" parameter and outputs the command executed in the console.
Screenshots
Figure 4 - The contents of the JSP file.
c24ead55e58422365f034d173bb0415c16be78928b2843ef8f6f62feb15e1553
Tags
backdoortrojanwebshell
Details
Name |
xjhdshd.jsp |
Size |
587 bytes |
Type |
ASCII text |
MD5 |
e146561122214f67eb35c52758a21fa5 |
SHA1 |
af9bc7ef25755982a00aca920ee7ad51f76c5cc2 |
SHA256 |
c24ead55e58422365f034d173bb0415c16be78928b2843ef8f6f62feb15e1553 |
SHA512 |
4f6b3212c68e4fc0794445455b03fb70372614f308c90381d0a075389532cf942712c36b3a6c5c1806549c4b1c348fe78fe09eda3056a10ec6a906641673e154 |
ssdeep |
12:P9CKGVuew42RT4kimBF6le9FonOzFjyu6iy2UIn+:Pg/dT2TLimBsle+gFjyuzHUIn+ |
Entropy |
4.765361 |
Antivirus
AhnLab |
WebShell/JSP.Agent |
Cyren |
ABRisk.GLNK-2 |
ESET |
Java/Webshell.BF trojan |
McAfee |
JAVA/Webshell.d |
Sophos |
Troj/WebShel-BB |
Symantec |
Trojan.Gen.NPE |
Trend Micro |
Backdoo.0B525FD4 |
Trend Micro HouseCall |
Backdoo.0B525FD4 |
YARA Rules
- rule CISA_10400779_04 : trojan webshell backdoor
{
meta:
Author = "CISA Code & Media Analysis"
Incident = "10400779"
Date = "2022-08-29"
Last_Modified = "20220908_1400"
Actor = "n/a"
Category = "Trojan Webshell Backdoor"
Family = "n/a"
Description = "Detects malicious JSP webshell samples"
MD5 = "e146561122214f67eb35c52758a21fa5"
SHA256 = "c24ead55e58422365f034d173bb0415c16be78928b2843ef8f6f62feb15e1553"
strings:
$s0 = { 49 4E 50 55 54 20 6E 61 6D 65 }
$s1 = { 63 6D 64 }
$s2 = { 73 75 62 6D 69 74 20 76 61 6C 75 65 }
$s3 = { 52 75 6E }
$s4 = { 53 74 72 69 6E 67 20 63 6D 64 }
$s5 = { 67 65 74 50 61 72 61 6D 65 74 65 72 }
$s6 = { 53 74 72 69 6E 67 20 6F 75 74 70 75 74 }
$s7 = { 65 78 65 63 28 63 6D 64 }
$s8 = { 67 65 74 49 6E 70 75 74 53 74 72 65 61 6D }
$s9 = { 73 2B 22 3C 2F 62 72 3E 22 }
$s10 = { 70 72 69 6E 74 53 74 61 63 6B 54 72 61 63 65 }
condition:
filesize < 10KB and all of them
}
ssdeep Matches
No matches found.
Description
This file is a JSP webshell designed to allow an attacker to execute commands and read the output of the commands. When executed, it prompts the attacker to enter the command in the input box and click "run" to execute. The command output will be displayed in the JSP page.
Screenshots
Figure 5 - The contents of the JSP file. It contains a form with input fields that prompts the attacker to enter the command in the input box and click "run" to execute.
9d2a842e7a39358adc68311dcc0bc550ba375eae7513a3d4de326e948d09c245
Tags
utility
Details
Name |
test.jsp |
Size |
3733 bytes |
Type |
HTML document, ASCII text |
MD5 |
55e51e8ceda717813a5223a8c99a8830 |
SHA1 |
275774dbfc8c1e8a95dcd2f0d589db1ab369eb01 |
SHA256 |
9d2a842e7a39358adc68311dcc0bc550ba375eae7513a3d4de326e948d09c245 |
SHA512 |
e14e598ac4e21e81d3e06b67b3e0cee7ee277b8a8e744649534bd930cc3f659f70450f64d59e2ef9cd81ce104943d4557a19b53b3f41a26ff0305bee097bb6ad |
ssdeep |
96:xZ+BhtTdkfTGRipKJ2N9rwrdNHZhFxwSyc:b2TdkfTGiAJ2N9mdN7ftyc |
Entropy |
4.550524 |
Antivirus
No matches found.
YARA Rules
- rule CISA_10400779_05 : utility webshell ZIMBRA
{
meta:
Author = "CISA Code & Media Analysis"
Incident = "10400779"
Date = "2022-08-29"
Last_Modified = "20220908_1400"
Actor = "n/a"
Category = "Utility Webshell"
Family = "ZIMBRA"
Description = "Detects malicious JSP webshell samples"
MD5 = "55e51e8ceda717813a5223a8c99a8830"
SHA256 = "9d2a842e7a39358adc68311dcc0bc550ba375eae7513a3d4de326e948d09c245"
strings:
$s0 = { 2f 6f 70 74 2f 7a 69 6d 62 72 61 2f 6a 65 74 74 79 2f 77 65 62 61 70 70 73 2f 7a 69 6d 62 72 61 41 64 6d 69 6e 2f 70 75 62 6c 69 63 2f 74 65 73 74 2e 73 68 }
$s1 = { 2E 65 78 65 63 28 }
$s2 = { 5A 69 70 4F 75 74 70 75 74 53 74 72 65 61 6D }
$s3 = { 67 65 74 50 61 72 61 6D 65 74 65 72 }
$s4 = { 22 61 63 74 69 6F 6E 22 }
$s5 = { 22 65 78 65 63 22 2E }
$s6 = { 70 72 69 6E 74 6C 6E 28 65 78 65 63 }
$s7 = { 22 64 6F 77 6E 22 2E }
$s8 = { 43 6F 6E 74 65 6E 74 2D 44 69 73 70 6F 73 69 74 69 6F 6E }
$s9 = { 61 74 74 61 63 68 6D 65 6E 74 }
$s10 = { 67 65 74 4F 75 74 70 75 74 53 74 72 65 61 6D }
$s11 = { 70 61 67 65 43 6F 6E 74 65 78 74 2E }
$s12 = { 6F 75 74 2E 70 72 69 6E 74 6C 6E 28 22 6E 6F 22 29 }
condition:
filesize < 10KB and all of them
}
ssdeep Matches
No matches found.
Relationships
9d2a842e7a... |
Used |
d335d7e3a0ac77e132e9ea839591fa81f67cd8eef136ec6586a1d6b1f29e18f1 |
Description
This file is a JSP webshell designed to retrieve and execute certain parameters from the attacker. The attacker can make a request to the malicious JSP file along with certain parameters to execute commands and output to console, download files, and zip compress files into "/tmp/zimbra/". It executes the file "/opt/zimbra/jetty/webapps/zimbraAdmin/public/test.sh" (ab28345b8aba13ae82f8bc0694f15804).
Screenshots
Figure 6 - This code snippet retrieves and executes certain parameters from the attacker. The attacker can execute commands and output to console, download files, and zip compress files.
d335d7e3a0ac77e132e9ea839591fa81f67cd8eef136ec6586a1d6b1f29e18f1
Tags
credential-harvester
Details
Name |
test.sh |
Size |
1111 bytes |
Type |
Bourne-Again shell script, ASCII text executable |
MD5 |
ab28345b8aba13ae82f8bc0694f15804 |
SHA1 |
6c484d46637cb3a9c4a5f0b42bff388c7b550b6d |
SHA256 |
d335d7e3a0ac77e132e9ea839591fa81f67cd8eef136ec6586a1d6b1f29e18f1 |
SHA512 |
d438228d08210f5a294865a1c3e91618e8c84a2c250f60349bf95659a04fe711feda9b882b189da65db81bd0ac417febde4bd7487a7a81a6467e7bb381b4116e |
ssdeep |
24:+U+pW+pO+pg+xvbDk9w+1dsRcy+1dsuXpeG+1dsYXeL+h:tSWSOSgsbDsw+1dsD+1dskpN+1dsoh |
Entropy |
5.047438 |
Antivirus
No matches found.
YARA Rules
- rule CISA_10400779_06 : credential_harvester ZIMBRA
{
meta:
Author = "CISA Code & Media Analysis"
Incident = "10400779"
Date = "2022-08-29"
Last_Modified = "20220908_1400"
Actor = "n/a"
Category = "Credential-Harvester"
Family = "ZIMBRA"
Description = "Detects ZIMBRA bash file samples"
MD5 = "ab28345b8aba13ae82f8bc0694f15804"
SHA256 = "d335d7e3a0ac77e132e9ea839591fa81f67cd8eef136ec6586a1d6b1f29e18f1"
strings:
$s0 = "/opt/zimbra/bin/zmlocalconfig"
$s1 = { 7A 69 6D 62 72 61 5F 6C 64 61 70 5F 70 61 73 7377 6F 72 64 }
$s2 = { 7A 69 6D 62 72 61 5F 6C 64 61 70 5F 75 73 65 72 }
$s3 = { 7A 69 6D 62 72 61 5F 6C 64 61 70 5F 75 73 65 72 64 6E }
$s4 = { 6C 64 61 70 5F 75 72 6C }
$s5 = { 2D 73 20 7C 20 67 72 65 70 }
$s6 = { 6C 64 61 70 73 65 61 72 63 68 }
$s7 = { 75 73 65 72 73 2E 6C 64 69 66 }
$s8 = { 63 6F 6E 66 69 67 2E 6C 64 69 66 }
$s9 = { 73 65 72 76 69 63 65 2E 6C 64 69 66 }
$s10 = { 72 6D 20 2D 72 66 }
$s11 = { 2F 74 6D 70 2F 7A 69 6D 62 72 61 }
$s12 = { 74 65 73 74 2E 73 68 }
$s13 = { 74 65 73 74 2E 6A 73 70 }
condition:
filesize < 10KB and all of them
}
ssdeep Matches
No matches found.
Relationships
d335d7e3a0... |
Used_By |
9d2a842e7a39358adc68311dcc0bc550ba375eae7513a3d4de326e948d09c245 |
Description
This file is a bash script file. When loaded, it finds the below patterns in the Zimbra server's local configuration using the "grep" command:
--Begin data--
The Lightweight Directory Access Protocol (LDAP) user password
The LDAP user
The LDAP user distinguished name (DN)
The LDAP Uniform Resource Locator (URL)
--End data--
It uses the above search results data from the Zimbra server's local configuration to perform ldapsearch queries. It runs the ldapsearch queries with the "-x" option for simple authentication, the "-H" option to specify the host, the "-D" option for the bind DN, "-W" option for the password, the "-b" option to specify the search base.
Displayed below are ldapsearch queries performed at runtime:
--Begin functions--
LDAP search operation for "userPassword" attribute of users in the directory server and stores the output into a newly created file "/tmp/zimbra/users.ldif".
LDAP search base for "Common Name (CN) =config","cn=zimbra" and stores the output into a newly created file "/tmp/zimbra/config.ldif".
LDAP search base for "cn=servers","cn=zimbra" and stores the output into a newly created file "/tmp/zimbra/service.ldif".
--End functions--
It removes the bash file "test.sh", the JSP file "test.jsp", and the newly created directory "/tmp/zimbra" using the commands below:
--Begin commands--
rm -rf /opt/zimbra/jetty/webapps/zimbraAdmin/public/test.sh
rm -rf /opt/zimbra/jetty/webapps/zimbraAdmin/public/test.jsp
rm -rf /tmp/zimbra
--End commands--
Screenshots
Figure 7 - This code snippet is used to find the LDAP user, password, user DN and URL in the zimbra local configuration.
6dee4a1d4ac6b969b1f817e36cb5d36c5de84aa8fe512f3b6e7de80a2310caea
Tags
webshell
Details
Name |
DatatypeConverter.jsp |
Size |
994 bytes |
Type |
HTML document, ASCII text, with very long lines |
MD5 |
6f1c2dd27e28a52eb09cdd2bc828386d |
SHA1 |
e8262b4808896297366d87fb0d88fa7292f532fa |
SHA256 |
6dee4a1d4ac6b969b1f817e36cb5d36c5de84aa8fe512f3b6e7de80a2310caea |
SHA512 |
874011de654458c8f9d5e70ea5143459bf1453abe84798b9730346ef0226e67f6f94eb2ee61e127ab8904e9b1b411e477b12854aec3567c32cdbf5318a7014be |
ssdeep |
24:gpcRLk+nn9IH/v+xVnVjQ4vajJHG3c3FvcVsUveakUSq:gu9cgVGo3c9cuakvq |
Entropy |
5.277722 |
Antivirus
No matches found.
YARA Rules
- rule CISA_10400779_07 : webshell
{
meta:
Author = "CISA Code & Media Analysis"
Incident = "10400779"
Date = "2022-08-29"
Last_Modified = "20220908_1400"
Actor = "n/a"
Category = "Webshell"
Family = "n/a"
Description = "Detects JSP Webshell samples"
MD5 = "6f1c2dd27e28a52eb09cdd2bc828386d"
SHA256 = "6dee4a1d4ac6b969b1f817e36cb5d36c5de84aa8fe512f3b6e7de80a2310caea"
strings:
$s0 = { 78 3D 55 52 4C 44 65 63 6F 64 65 72 }
$s1 = { 53 74 72 69 6E 67 20 6F 2C 6C 2C 64 }
$s2 = { 72 65 71 75 65 73 74 2E 67 65 74 49 6E 70 75 74 53 74 72 65 61 6D }
$s3 = { 69 6E 64 65 78 4F 66 28 22 63 3D 22 29 }
$s4 = { 2E 65 78 65 63 28 67 29 }
$s5 = { 6F 75 74 2E 70 72 69 6E 74 }
$s6 = { 70 61 72 73 65 42 61 73 65 36 34 42 69 6E 61 72 79 }
$s7 = { 46 69 6C 65 2E 73 65 70 61 72 61 74 6F 72 }
$s8 = { 6F 3D 22 55 70 6C 6F 61 64 65 64 }
$s9 = { 6F 75 74 2E 70 72 69 6E 74 28 65 29 }
condition:
filesize < 10KB and all of them
}
ssdeep Matches
93 |
bc5b1f588cd506a69c03a7980a363846fa474b78e6946fa90e58d735c65f2bb6 |
Description
This file is a JSP webshell. This file is designed to receive a form-data from the client side to perform file upload, command execution and output functions. The client side applet was not available for analysis. Analysis indicates that the command output is HTML encoded, and the files to be uploaded are Base64 encoded on client side and decoded on the server side. The uploaded files are read in as a byte stream by the JSP page.
Screenshots
Figure 8 - This code snippet gets the body of the request.
Relationship Summary
9d2a842e7a... |
Used |
d335d7e3a0ac77e132e9ea839591fa81f67cd8eef136ec6586a1d6b1f29e18f1 |
d335d7e3a0... |
Used_By |
9d2a842e7a39358adc68311dcc0bc550ba375eae7513a3d4de326e948d09c245 |
Recommendations
CISA recommends that users and administrators consider using the following best practices to strengthen the security posture of their organization's systems. Any configuration changes should be reviewed by system owners and administrators prior to implementation to avoid unwanted impacts.
- Maintain up-to-date antivirus signatures and engines.
- Keep operating system patches up-to-date.
- Disable File and Printer sharing services. If these services are required, use strong passwords or Active Directory authentication.
- Restrict users' ability (permissions) to install and run unwanted software applications. Do not add users to the local administrators group unless required.
- Enforce a strong password policy and implement regular password changes.
- Exercise caution when opening e-mail attachments even if the attachment is expected and the sender appears to be known.
- Enable a personal firewall on agency workstations, configured to deny unsolicited connection requests.
- Disable unnecessary services on agency workstations and servers.
- Scan for and remove suspicious e-mail attachments; ensure the scanned attachment is its "true file type" (i.e., the extension matches the file header).
- Monitor users' web browsing habits; restrict access to sites with unfavorable content.
- Exercise caution when using removable media (e.g., USB thumb drives, external drives, CDs, etc.).
- Scan all software downloaded from the Internet prior to executing.
- Maintain situational awareness of the latest threats and implement appropriate Access Control Lists (ACLs).
Additional information on malware incident prevention and handling can be found in National Institute of Standards and Technology (NIST) Special Publication 800-83, "Guide to Malware Incident Prevention & Handling for Desktops and Laptops".
Contact Information
CISA continuously strives to improve its products and services. You can help by answering a very short series of questions about this product at the following URL: https://us-cert.cisa.gov/forms/feedback/
Document FAQ
What is a MIFR? A Malware Initial Findings Report (MIFR) is intended to provide organizations with malware analysis in a timely manner. In most instances this report will provide initial indicators for computer and network defense. To request additional analysis, please contact CISA and provide information regarding the level of desired analysis.
What is a MAR? A Malware Analysis Report (MAR) is intended to provide organizations with more detailed malware analysis acquired via manual reverse engineering. To request additional analysis, please contact CISA and provide information regarding the level of desired analysis.
Can I edit this document? This document is not to be edited in any way by recipients. All comments or questions related to this document should be directed to the CISA at 1-888-282-0870 or CISA Central.
Can I submit malware to CISA? Malware samples can be submitted via three methods:
CISA encourages you to report any suspicious activity, including cybersecurity incidents, possible malicious code, software vulnerabilities, and phishing-related scams. Reporting forms can be found on CISA's homepage at www.cisa.gov.
|