Detections
Analytics

NetSarang Xftp 5 Backdoor Trojan (ShadowPad)

critical Nessus Plugin ID 102709

Language:

Synopsis

The remote host contains an application that is affected by a trojan backdoor.

Description

The Xftp 5, an FTP client for Windows, installed on the remote host has a nssock2.dll file identified by its MD5 hash that is infected with a trojan backdoor.

The affected file includes an encrypted payload that could be remotely activated by a knowledgeable attacker.

Solution

Upgrade to Xshell 5 Build 1326 or later.

See Also

https://securelist.com/shadowpad-in-corporate-networks/81432/

http://www.nessus.org/u?8956bf87

Plugin Details

Severity: Critical

ID: 102709

File Name: netsarang_xftp_5_trojan.nasl

Version: 1.4

Type: local

Agent: windows

Family: Windows

Published: 8/23/2017

Updated: 8/8/2018

Supported Sensors: Nessus Agent, Nessus

Vulnerability Information

Required KB Items: SMB/Registry/Enumerated

Patch Publication Date: 8/5/2017

Vulnerability Publication Date: 8/4/2017