Uploader
viper.php (Viper 1337)
Minimal file uploader ecosystem by Viper 1337 — multiple variants (XxX.php, 098.php, pwn.php) carrying a Hmei7-linked supply-chain beacon in base64-encoded eval blocks. One variant uses GIF89a magic-byte prefix for MIME-type evasion.
YARA 4 min readshell-checker (selmasker)
Disguised as a webshell validation tool — but the checker is the shell. Indonesian scene (JExCoders / XploitSec-ID). Every string literal is base64-encoded to defeat grep. Hidden GET-branch backdoor accepts unauthenticated file uploads to the webroot — confirmed live. Config-trap pattern: operator fills in their own email, making every hit report to them (and to anyone reading the source).
YARA 4 min readrintod / toolol
Minimal file uploader at 330 bytes — the smallest and cleanest tool in the corpus. Indonesian scene (GitHub rintod/toolol). No backdoor, no auth, no obfuscation, no beacon in the analyzed sample — the lowest observed supply-chain risk in the corpus. Used by Flash-X as stage-0 dropper to plant full shells after initial RCE.
YARA 4 min readFlash-X uploaders
Two minimal uploaders (~1.7 KB each) with byte-identical hidden mail() beacons to the kit author. Attributed to XPROADSHELL / BAZOOKA, distributed by 0XNIGHTSEC. The beacons fire on every page load, invisible to the operator. Half-broken obfuscation leaks two author handles from one file. Re-skin only difference between variants.
YARA 4 min read