MITRE ATT&CK Malware

P.A.S. Webshell (S0598)

Fobushell

[P.A.S. Webshell](https://attack.mitre.org/software/S0598) is a publicly available multifunctional PHP webshell in use since at least 2016 that provides remote access and execution on target web servers.(Citation: ANSSI Sandworm January 2021)

Platforms: Linux, Windows

▪Techniques implemented (15)

T1140Deobfuscate/Decode Files or Information T1083File and Directory Discovery T1505.003Web Shell T1005Data from Local System T1222.002Linux and Mac Permissions T1071.001Web Protocols T1059Command and Scripting Interpreter T1518Software Discovery T1027Obfuscated Files or Information T1070.004File Deletion T1046Network Service Discovery T1213.006Databases T1110.001Password Guessing T1105Ingress Tool Transfer T1087.001Local Account

▪Used by groups (2)

G1003Ember Bear G0034Sandworm Team

S0598on MITRE ATT&CK →

MITRE ATT&CK Malware

P.A.S. Webshell (S0598)

Fobushell

ShareX LinkedIn Reddit HN

Platforms: Linux, Windows

▪Techniques implemented (15)

▪Used by groups (2)

G1003Ember Bear G0034Sandworm Team

S0598on MITRE ATT&CK →

P.A.S. Webshell (S0598)

▪Techniques implemented (15)

▪Used by groups (2)

Explore Gold

Security Data & Tools

Products

Use Cases

Company

P.A.S. Webshell (S0598)

▪Techniques implemented (15)

▪Used by groups (2)