{"id":1504,"date":"2024-02-20T10:37:40","date_gmt":"2024-02-20T10:37:40","guid":{"rendered":"https:\/\/threats.amnpardaz.com\/en\/?p=1504"},"modified":"2024-04-22T12:48:53","modified_gmt":"2024-04-22T12:48:53","slug":"hacktool-win32-aspxspy","status":"publish","type":"post","link":"https:\/\/threats.amnpardaz.com\/en\/2024\/02\/20\/hacktool-win32-aspxspy\/","title":{"rendered":"HackTool.Win32.ASPXSpy"},"content":{"rendered":"

Overview<\/h2>\n

Type:<\/strong> Hacktool
\nDestruction Level:<\/strong> High
\nPrevalence:<\/strong> Low<\/p>\n

 <\/p>\n

Malware name(s)<\/h3>\n
    \n
  • HackTool.Win32.ASPXSpy (Padvish)<\/li>\n
  • HackTool.Win32.ASPXSpy (Eset)<\/li>\n
  • Backdoor:MSIL\/AspxSpy.A (Microsoft)<\/li>\n<\/ul>\n

    <\/h3>\n

    What is a hackTool?<\/h3>\n

    Hacktools are tools designed to facilitate intrusion. These tools can be used by an intruder to recieve data from the victim organization\u2019s network. These tools are commonly used to retrieve the credentials of sensitive victim servers. For example, an intruder can use hacktools to guess passwords based on Brute Force attacks. In some cases, to escalate access levels and exploit existing vulnerabilities, HackTools are used. In general, hack tools can crash the computer and network security barriers and provide various capabilities to infiltrate systems.<\/p>\n

    <\/h3>\n

    What is ASPXSpy malware?<\/h3>\n

    ASPXSpy is a web-based hack tool written in the ASPX programming language. It has been developed and is accessible as open-source on the Internet. Once installed on the victim’s servers, this tool enables the attacker to retrieve the victim’s server specifications, conduct port scanning operations, manipulate the victim’s file system, registry, and database, and execute command-line CMD as desired by the attacker.<\/p>\n

     <\/p>\n

    Technical review<\/h2>\n

     <\/p>\n

    Indicators of Compromise (IoC)<\/h3>\n

    The signs of infection (or IoCs) can vary based on the commands received from the attacker.<\/p>\n

    <\/h3>\n

     <\/p>\n

    Performance description<\/h3>\n

    This tool initially receives the password from the attacker through the following login form and subsequently grants attacker, access to the implemented functionalities. In the provided examples, the password is the string “admin”.<\/p>\n

     <\/p>\n

    \"AspxSpy? The image below presents an example of the features of this tool<\/p>\n

    \"<\/p>\n

     <\/p>\n

    ?As shown in the image above, the ASPXSpy penetration tool provides various features and capabilities to the attacker, which are described in the table below:<\/p>\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
    Feature<\/strong><\/td>\nDescription<\/strong><\/td>\n<\/tr>\n
    File Manager<\/em><\/strong><\/span><\/td>\nProvides the ability to manage the file system of the victim’s server, including deleting, creating, editing, renaming, copying, changing file timestamps, and downloading\/uploading files.<\/td>\n<\/tr>\n
    File Search<\/em> <\/strong><\/span><\/td>\nEnables searching and modifying the content of any file on the victim’s server.<\/td>\n<\/tr>\n
    CmdShell<\/em><\/strong><\/span><\/td>\nAllows execution of command-line cmds specified by the attacker using cmd.exe, with the output sent back to the attacker.<\/td>\n<\/tr>\n
    IIS Spy<\/em> <\/strong><\/span><\/td>\nDisplays the web server details, including usernames and passwords, extracting items such as the web server name, domain name, IP address, and port number assigned to the web server.<\/td>\n<\/tr>\n
    Process<\/em><\/strong><\/span><\/td>\nDisplays the list of the system’s current processes, including the process name, ID, number of threads, execution priority, and the ability to terminate them.<\/td>\n<\/tr>\n
    Services<\/em><\/strong><\/span><\/td>\nDisplays the list of services registered in the system, including the name, corresponding process ID, path of the executable file, current state of the service, and its start state<\/td>\n<\/tr>\n
    UserInfo<\/em><\/strong><\/span><\/td>\nDisplays system users and their details.<\/td>\n<\/tr>\n
    SysInfo<\/em><\/strong><\/span><\/td>\nDisplays system information, including OS information, hardware specifications, information about installed drivers, and MAC address(es).<\/td>\n<\/tr>\n
    RegShell<\/em><\/strong><\/span><\/td>\nAllows access to the victim server’s registry, enabling the viewing, deletion, creation, and editing of registry keys.<\/td>\n<\/tr>\n
    PortScan<\/em><\/strong><\/span><\/td>\nEnables scanning of desired ports on the current server or external servers.<\/td>\n<\/tr>\n
    DataBase<\/em><\/strong><\/span><\/td>\nProvides the ability to connect and execute queries for MSSQL and OleDb databases.<\/td>\n<\/tr>\n
    PortMap<\/em><\/strong><\/span><\/td>\n\u00a0Facilitates Port Forwarding operations, mapping remote connections to IP addresses and local ports.<\/td>\n<\/tr>\n
    WmiTools<\/em><\/strong><\/span><\/td>\nAllows connection to the namespaces of the victim server and execution of WMI queries.<\/td>\n<\/tr>\n
    PluginLoader<\/em><\/strong><\/span><\/td>\nUploads a file into the current processor memory.<\/td>\n<\/tr>\n
    ADSViewer<\/em><\/strong><\/span><\/td>\nEnables viewing of the active directory of the victim server along with their features and subdirectories.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

     <\/p>\n

    ?In the image below, the code related to the PluginLoader feature is presented in a sample of this malware.<\/p>\n

    \"\u06a9\u062f<\/p>\n

    <\/h2>\n

     <\/p>\n

    How to deal with and clean the system?<\/h2>\n

    Padvish antivirus can detect this malware and remove it from the system. It is also recommended to regularly update your operating system and antivirus software.<\/p>\n","protected":false},"excerpt":{"rendered":"

    Overview Type: Hacktool Destruction Level: High Prevalence: Low   Malware name(s) HackTool.Win32.ASPXSpy (Padvish) HackTool.Win32.ASPXSpy (Eset) Backdoor:MSIL\/AspxSpy.A (Microsoft) What is a hackTool? Hacktools are tools designed to facilitate intrusion. These tools can be used by an intruder to recieve data from the victim organization\u2019s network. These tools are commonly used to retrieve the credentials of sensitive…<\/p>\n","protected":false},"author":27,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[47,48],"tags":[54,55,56,57],"class_list":["post-1504","post","type-post","status-publish","format-standard","hentry","category-malware","category-hacktool","tag-aspx","tag-aspxspy","tag-hacktool","tag-hacktool-win32-aspxspy"],"_links":{"self":[{"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/posts\/1504","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/users\/27"}],"replies":[{"embeddable":true,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/comments?post=1504"}],"version-history":[{"count":10,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/posts\/1504\/revisions"}],"predecessor-version":[{"id":1542,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/posts\/1504\/revisions\/1542"}],"wp:attachment":[{"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/media?parent=1504"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/categories?post=1504"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/threats.amnpardaz.com\/en\/wp-json\/wp\/v2\/tags?post=1504"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}