ANSSI Sandworm January 2021

P.A.S. Webshell has the ability to copy files on a compromised host.

Exaramel for Linux can attempt to find a new C2 server if it receives an error.

P.A.S. Webshell can use encryption and base64 encoding to hide strings and to enforce access control once deployed.

Exaramel for Linux uses RC4 for encrypting the configuration.

Exaramel for Linux can run whoami to identify the system owner.

P.A.S. Webshell can scan networks for open ports and listening services.

Exaramel for Linux uses crontab for persistence if it does not have root privileges.

P.A.S. Webshell has the ability to create reverse shells with Perl scripts.

Exaramel for Linux has a command to execute a shell command on the system.

Exaramel for Linux can uninstall its persistence mechanism and delete its configuration file.

P.A.S. Webshell can delete scripts from a subdirectory of /tmp after they are run.

P.A.S. Webshell can issue commands via HTTP POST.

Exaramel for Linux uses HTTPS for C2 communications.

P.A.S. Webshell has the ability to list files and file characteristics including extension, size, ownership, and permissions.

P.A.S. Webshell can display the /etc/passwd file on a compromised host.

P.A.S. Webshell can upload and download files to and from compromised hosts.

Exaramel for Linux has a command to download a file from and to a remote C2 server.

P.A.S. Webshell can use predefined users and passwords to execute brute force attacks against SSH, FTP, POP3, MySQL, MSSQL, and PostgreSQL services.

Sandworm Team has used Dropbear SSH with a hardcoded backdoor password to maintain persistence within the target network. Sandworm Team has also used VPN tunnels established in legitimate software company infrastructure to gain access to internal networks of that software company's users.

Exaramel for Linux can decrypt its configuration file.

P.A.S. Webshell can use a decryption mechanism to process a user supplied password and allow execution.

P.A.S. Webshell has the ability to list and extract data from SQL databases.

P.A.S. Webshell has the ability to modify file permissions.

P.A.S. Webshell can gain remote access and execution on target web servers.

Sandworm Team has used webshells including P.A.S. Webshell to maintain access to victim networks.

P.A.S. Webshell can list PHP server configuration details.

Exaramel for Linux has a hardcoded location that it uses to achieve persistence if the startup system is Upstart or System V and it is running as root.

Exaramel for Linux has a hardcoded location under systemd that it uses to achieve persistence if it is running as root.

Exaramel for Linux can execute commands with high privileges via a specific binary with setuid functionality.