Threat Group Cards: A Threat Actor Encyclopedia
Archived: 2026-04-05 19:16:30 UTC
Home > List all groups > List all tools > List all groups using tool P.A.S.
 Tool: P.A.S.
Names
P.A.S.
PAS
Fobushell
Category Malware
Type Backdoor
Description
(US-CERT) This file is a malicious PHP file containing an embedded obfuscated payload. This
payload is Base64 encoded and password protected.
Information
<https://www.us-cert.gov/sites/default/files/publications/AR-17-
20045_Enhanced_Analysis_of_GRIZZLY_STEPPE_Activity.pdf>
<https://blog.erratasec.com/2016/12/some-notes-on-iocs.html>
Malpedia <https://malpedia.caad.fkie.fraunhofer.de/details/php.pas>
Last change to this tool card: 28 December 2022
Download this tool card in JSON format
All groups using tool P.A.S.
Changed Name Country Observed
APT groups
  Sandworm Team, Iron Viking, Voodoo Bear 2009-Dec 2024
1 group listed (1 APT, 0 other, 0 unknown)
Source: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=0c707538-47d3-4d55-903c-7dd6b6f4d909
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=0c707538-47d3-4d55-903c-7dd6b6f4d909
Page 1 of 1