TF-MAL-php.behinder

Description

ThreatFox malware family `php.behinder`. Printable name: Behinder.

Indicators of Compromise (1)

Each indicator is enriched from the IOC database, threat-intel feed corroboration (Threat Hunt) and VirusTotal. Click one to expand.

References (1)

• ThreatFox: IOCs for this family ThreatFox Malwares

• Detecting and Explaining Malware Family Evolution Using Rule-Based ...
  web:arxiv.org

  Interpretable models are especially important in adversarial domains such as malware analysis, where understanding the rationale behind a classification can guide remediation efforts and enhance model robustness. This paper proposes a novel approach for detecting and explaining concept drift in malware families over time.

  2026-05-22 05:29 UTC
• BPFDoor and Symbiote Rootkits Attacking Linux Systems Exploiting eBPF ...
  web:cybersecuritynews.com

  Two sophisticated Linux rootkits are posing increasingly serious threats to network security by exploiting eBPF technology to hide their presence from traditional detection systems. BPFDoor and Symbiote, both originating from 2021, represent a dangerous class of malware that combines advanced kernel-level access with powerful evasion capabilities.

  2026-05-22 05:29 UTC
• Behinder (Malware Family) - Fraunhofer
  web:malpedia.caad.fkie.fraunhofer.de

  A webshell for multiple web languages (asp/aspx, jsp/jspx, php), openly distributed through Github.

  2026-05-22 05:29 UTC
• Kaspersky SOC analyzes an incident involving a web shell used as a ...
  web:securelist.com

  Kaspersky SOC analysts discuss a recent incident where the well-known Behinder web shell was used as a post-exploitation backdoor, showing how web shells have evolved.

  2026-05-22 05:29 UTC
• Libredtail Exploits CVE-2024-4577 for Cryptomining
  web:socprime.com

  The article details a cryptomining campaign involving the redtail malware family , which is delivered through HTTP requests that exploit CVE-2024-4577 in PHP. Threat actors send Base64-encoded payloads that retrieve and run a self-replicating script named cve_2024_4577.selfrep.

  2026-05-22 05:29 UTC
• RESURGE Malware and CVE-2025-0282: Critical Threats and Defender ...
  web:windowsforum.com

  The emergence of RESURGE signals more than just another entry in a long line of malware threats. According to CISA, RESURGE contains advanced persistence features inherited from the SPAWNCHIMERA malware family—a group notorious for its ability to survive system reboots and avoid simplistic remediation .

  2026-05-22 05:29 UTC
• Technical Approaches to Uncovering and Remediating Malicious ... - CISA
  web:www.cisa.gov

  It highlights technical approaches to uncovering malicious activity and includes mitigation steps according to best practices. The purpose of this report is to enhance incident response among partners and network administrators along with serving as a playbook for incident investigation.

  2026-05-22 05:29 UTC
• New eBPF Filters for Symbiote and BPFdoor Malware
  web:www.fortinet.com

  FortiGuard Labs discovered new Symbiote and BPFDoor variants exploiting eBPF filters to enhance stealth through IPv6 support, UDP traffic, and dynamic port hopping for covert C2 communication.

  2026-05-22 05:29 UTC
• Mitigating malware and ransomware attacks - The National Cyber Security ...
  web:www.ncsc.gov.uk

  How to defend organisations against malware or ransomware attacks.

  2026-05-22 05:29 UTC
• (PDF) eBPF-based Malware - ResearchGate
  web:www.researchgate.net

  Prevention and detection of eBPF-based malware is also explored, with the goal of providing organizations or legitimate users of eBPF techniques to harden their systems against eBPF-based malware ...

  2026-05-22 05:29 UTC

Only Available for Registered Users. Sign in to view.