Oil Rig Performs Tests on the Two Face Webshell
Summary: Unit 42 observed an OilRig developer testing the TwoFace++ webshell variant on November 15, 2017, making 22 modifications to the loader script between 8:51 AM and 9:07 AM UTC. The developer systematically removed and re-added lines of code to watch detection rates rise and fall, ending at zero detections by leaving the embedded webshell's encoded and encrypted data unchanged but removing the payload update functionality.
What you should know: In sixteen minutes, one developer mapped exactly which lines security vendors detect and stripped the remote-update capability to reach zero detections while keeping the webshell functional - a reminder that a clean scan result can reflect an adversary's deliberate tuning rather than a safe file.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Malware
- Related
- ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026