virus logo Virus

ASP/WebShell.CL!tr

description-logoAnalysis

ASP/WebShell.CL!tr is a generic detection for a trojan.
This malware has been associated with the following Hafnium article/advisory:

  • https://fndn.fortinet.net/FortiGuard-Alert-Outbreaks/Hafnium-Fabric-View/

  • The correlation has been established due to a database near/exact match on one of the sample/IOC/file hash indicated in the mentioned resource.
    • md5: 1a7a85b0390b308b1801679e11567eac
      sha256: 406b680edc9a1bb0e2c7c451c56904857848b5f15570401450b73b232ff38928

  • A quick view of this ASP code indicates the following:
    • a set of server commands : "CONNECT", "DISCONNECT", "FORWARD", "READ"
    • a server default response of "Georg says, 'All seems fine"

    • recommended-action-logoRecommended Action

    • Make sure that your FortiGate/FortiClient system is using the latest AV database.
    • Quarantine/delete files that are detected and replace infected files with clean backup copies.

    Telemetry logoTelemetry

    Detection Availability

    FortiGate
    FortiClient
    FortiAPS
    FortiAPU
    FortiMail
    FortiSandbox
    FortiWeb
    Web Application Firewall
    FortiIsolator
    FortiDeceptor
    FortiEDR

    Version Updates

    Date Version Detail
    2021-03-08 84.00568
    ID 10007884
    Released Mar 10, 2021
    Description
    Updated    		 Mar 08, 2021
    Aliases HAFNIUM,Backdoor.ASP.WebShell.cl,ASP/Webshell.m trojan,Backdoor.ASP.WEBSHELL.UWMANK,ATK/Pivot-B,ASP/ReGeorg.B potentially unsafe application