Flash-X uploaders

Flash-X uploaders are a pair of minimal file upload tools — each approximately 1.7 KB — that share a byte-identical hidden payload. The two variants (flashx-up1 at 4/62 VT detection, flashx-up2 at 3/62) differ only in their page title and cosmetic skin. The upload function itself is straightforward: accept a file via POST, write it to the webroot, no authentication, no filtering. The interesting finding is not the uploader. It is the supply-chain beacon hidden inside it.

Capabilities

Minimal file upload: accept a file via POST, write it to the webroot. No authentication, no file-type filtering, no size limits. Two cosmetic variants with identical functionality. Distributed by the 0XNIGHTSEC handle, which appears in the distribution metadata but not in the code itself. Three identities — two authors and one distributor — are recoverable from a 1.7 KB file.

Supply-Chain Beacon

Both variants contain a mail() function that fires on every page load and sends a notification to the kit author’s email address. This beacon is invisible to the operator — it is not part of the upload workflow, it is not displayed in the interface, and it generates no visible output. Every time the page loads, the author receives a report. The operator who deployed the tool to maintain their access has simultaneously installed a surveillance beacon that reports their activity to the tool’s creator.

The obfuscation layer is half-broken. Eight fragmented eval(base64_decode()) statements are intended to reconstruct the beacon payload at runtime, but the fragments are mis-ordered: the staged mail() function fires before the recipient variable is defined, creating a dead beacon path that generates PHP notices but sends nothing. Only the self-contained copy of the mail() call — outside the fragmented chain — actually works. This implementation error means the obfuscation adds complexity without fully achieving its purpose, and it leaks two distinct author handles in the process: XPROADSHELL (associated with the dead path) and BAZOOKA (associated with the live path). Both are linked to the same contact email address.

Vulnerabilities

Paired with the clean rintod uploader (330 bytes, no beacon, no obfuscation), the Flash-X variants demonstrate the spectrum of supply-chain trust in the T4 uploader tier: rintod delivers exactly what it promises, while Flash-X backdoors its own operators.

Detection Surface

File-system indicators

HTTP access-log indicators

YARA rules

Two YARA rules apply to Flash-X uploaders: one for the uploader itself, and one for the XPROAD pastebin-sourced beacon pattern.

rule tool_flashx_uploaders {
    meta:
        description = "Flash-X uploaders with base64 mail() beacon (XPROADSHELL / BAZOOKA)"
        author      = "OHIIHO Threat Research"
        reference   = "https://research.ohiiho.com/arsenal/flashx-uploaders/"
        status      = "validated"

    strings:
        $eval_b64   = "eval (base64_decode(" ascii
        $xproad_b64 = "JGVtYWlsID0gInhwcm9hZGhtaWRhQHlhaG9vLmNvbSI7" ascii  // b64 '$email = "xproadhmida@yahoo.com";'
        $xproad1    = "xproadhmida@yahoo.com" ascii
        $xproad2    = "XPROADSHELL" ascii
        $bazooka    = "BAZOOKA" ascii

    condition:
        filesize < 5KB
        and $eval_b64
        and ($xproad_b64 or $xproad1 or $xproad2 or $bazooka)
}

rule tool_flashx_pastebin_beacon {
    meta:
        description = "Flash-X/XPROAD pastebin-sourced mail beacon (eval+base64 exfil block)"
        author      = "OHIIHO Threat Research"
        reference   = "https://research.ohiiho.com/arsenal/flashx-uploaders/"
        status      = "validated"

    strings:
        $eval_b64   = "eval (base64_decode(" ascii
        $xproad_b64 = "JGVtYWlsID0gInhwcm9hZGhtaWRhQHlhaG9vLmNvbSI7" ascii  // b64 '$email = "xproadhmida@yahoo.com";'
        $remote_b64 = "JGlwID0gZ2V0ZW52KCJSRU1PVEVfQUREUiIp" ascii        // b64 '$ip = getenv("REMOTE_ADDR")'
        $xproad     = "xproadhmida" ascii
        $bazooka    = "BAZOOKA" ascii

    condition:
        filesize < 3KB
        and $eval_b64
        and ($xproad_b64 or $remote_b64 or $xproad or $bazooka)
}

MITRE ATT&CK

OHIIHO Threat Research.