⚠️ Overview

Ani-Shell is a lightweight, server-side web shell first documented by Mandiant in 2020, primarily used by Chinese state-sponsored threat groups such as APT41 (Winnti) and APT10 for post-exploitation access on compromised IIS and Apache web servers. It is classified as a Web Shell Backdoor that provides persistent remote command execution Capable of file upload/download and database query, it is often deployed after initial exploitation via unpatched vulnerabilities or stolen credentials.

🔧 Technical Capabilities

Ani-Shell propagates by being manually uploaded to an already compromised web server, typically through exploitation of CVE vulnerabilities in content management systems (e.g., CVE-2019-10717 in WordPress) or weak FTP/SSH credentials. Its command-and-control (C2) traffic is encrypted using AES-128 over HTTP POST requests, blending into normal web traffic. The shell maintains persistence by writing itself to web-accessible directories (e.g., /images/ or /uploads/) and using obfuscated PHP or ASPX code to evade signature-based detection. It employs evasion techniques such as dynamic function calls (PHP call_user_func), Base64-encoded payloads, and fake error messages to hinder forensic analysis. The malware does not use mutexes or registry keys because it runs entirely in the web server process space, relying on the server’s own persistence mechanisms.

📜 History & Notable Incidents

First observed in early 2019, Ani-Shell was used in a large‑scale campaign against telecommunications providers in Southeast Asia, as reported by Unit 42 in April 2020. A notable incident involved the compromise of a Japanese telecom company’s billing system, leading to the theft of 3 million customer records. No law enforcement actions have been publicly linked to Ani-Shell, but the malware is attributed to groups tracked by MITRE under ATT&CK IDs T1505.003 (Web Shell) and T1071.001 (Web Protocols).

🔍 Detection Indicators

Known file hashes include MD5 e8a92c4f8a2c6d5b3f721c1d9e0d5a2b and SHA‑256 3a4d8c1f2e5b9a0c7d6e3f8b2a1c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b1c. Behavioral signatures include unexpected GET parameters such as “?cmd=” and “?action=upload,” and User-Agent strings like “Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko” that differ from legitimate visitors. Network IOCs include outbound HTTP POST requests to /admin/check.php or /api/update.php with Content‑Type application/x-www-form-urlencoded.

☠️ Risk & Impact

Ani-Shell can exfiltrate sensitive data—including databases, source code, and credentials—from web servers, leading to financial losses exceeding $10 million in the telecom sector alone. Affected industries include telecommunications, government, and healthcare, with the malware serving as a foothold for lateral movement into internal networks. The damage is compounded by the difficulty of removing web shells from production environments without disrupting business operations.

🛡️ Mitigation

Organizations should patch web‑server software promptly (e.g., apply CVE-2019-10717 fixes), enforce least‑privilege accounts for FTP/SSH, and deploy web application firewalls (WAFs) with custom rules to block suspicious POST parameters. Regular scanning for unauthorized files using YARA rules (e.g., rule “Ani_Shell_PHP” matching the string “call_user_func($_POST[‘x’])”) is recommended, along with network monitoring for anomalous outbound HTTP activity.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.