Investigating A Web Shell Intrusion With Trend Micro™ Managed XDR 

INDICATORS OF COMPROMISE

SHA256						Indicator						Detection
e5746699eace0b47aa47fbefcf5aee67e67cec95	rev.bat							Backdoor.BAT.WEBSHELL.B.enc
4a8eb063e811111b03c5d2c81b20f34ccaf63dd2	cmd.aspx						Backdoor.ASP.WEBSHELL.S
c74112afef359d2bf6b2879358b9651ef8d1c12c	0514_Bills_Payment_Intraday_01102019_114424.aspx	Backdoor.ASP.WEBSHELL.S
7b3d29d83f2ac80a24f8eae791d563aec8311c6e	cmd.asp							Backdoor.ASP.WEBSHELL.S
4e49beee8548cacb2fab3e2260b2255b86fd6b13	n.exe							HackTool.Win64.Ngrok.B
44ceb7e93498c89c7035bab4a494f95bc6267609	0x02.exe						HackTool.Win64.PrintSpoofer.G


IP				Classification
54[.]255[.]198[.]171		Malware Accomplice
86.48.10[.]109
167.88.173[.]253