Adodb

Overview

Backdoor:Win32/Adodb is a detection specifically targeting malicious web shells or server-side scripts that heavily abuse Microsoft's ActiveX Data Objects (ADO) technology. Rather than infecting standard user workstations, Adodb targets Windows-based web servers (like IIS running ASP or ASP.NET). It provides attackers with a persistent, stealthy backdoor (`T1505.003`) to execute arbitrary commands, query backend databases, and maintain control over the compromised server architecture.

Understanding Adodb (Web Shells)
To a website visitor, the compromised server appears to function normally. To a security administrator, an Adodb detection represents a critical server breach. The attacker has successfully bypassed perimeter defenses, uploaded a malicious script, and now has interactive access to the web server's underlying operating system and databases.

Execution and Exploitation Mechanics
Attackers typically deploy Adodb web shells by exploiting vulnerabilities in web applications (e.g., SQL injection, insecure file uploads - `T1190`), or by utilizing stolen server credentials. Once the malicious `.asp` or `.aspx` file is dropped into a web-accessible directory, the attacker accesses it via a standard web browser. The script utilizes the `ADODB.Stream` or `ADODB.Connection` objects. These legitimate COM objects are weaponized by the script to read/write binary files directly to the server's disk (allowing further malware uploads) or to execute raw SQL queries against connected databases, bypassing application-layer security controls.

Indicators of Compromise & Impact
The impact is total compromise of the web server, leading to data exfiltration (database dumping), defacement, or lateral movement into the internal network. Host-based IoCs include the presence of unexpected `.asp` or `.aspx` files in web directories, especially those containing obfuscated VBScript or references to `ADODB.Stream`. EDR telemetry may show the web server process (e.g., `w3wp.exe`) unexpectedly spawning `cmd.exe` or making unusual network connections. Network IoCs include anomalous HTTP POST requests directed at specific, previously unseen scripts on the server.

MITRE ATT&CK Techniques

Observed techniques used by this family, mapped to the MITRE ATT&CK framework:

Tactical Mitigations

Based on the techniques used by this family, consider the following defensive strategies:

• T1059.005: Restrict execution of scripting languages such as PowerShell, VBScript, or Python to authorized administrators. Enforce Script Block Logging.

Generated Detections (Boilerplate)

These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.

YARA Rule

rule MALWARE_WIN_ADODB {
    meta:
        description = "Detects Adodb (backdoor)"
        author = "SystemHelpdesk Boilerplate Generator"
        date = "2026-07-06"
    strings:
        $s1 = "adodb" ascii wide nocase
    condition:
        uint16(0) == 0x5a4d and any of them
}

Sigma Rule

title: Suspicious Adodb Activity
id: 384140ebb7710a8adf5ecc7b7172293d
status: experimental
description: Detects generic indicators of the adodb malware family.
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - "*adodb*"
    condition: selection
level: medium

Containment & Response Steps

Ordered checklist for responders. Adapt to your environment and engage professional support for active incidents.

1. Immediately take the compromised web server offline or isolate it from the internal network to prevent lateral movement and database exfiltration.
2. Locate and quarantine the specific `.asp` or `.aspx` web shell script identified by the alert.
3. Conduct a comprehensive forensic review of the IIS/Apache access logs to determine how the shell was uploaded and what commands the attacker executed.
4. Audit all backend databases connected to the web server for unauthorized access or data exfiltration.

What to Avoid

Common mistakes during response to this family that can destroy evidence, spread the infection, or worsen recovery.

1. Do not simply delete the web shell and bring the server back online; you must identify and patch the vulnerability that allowed the upload in the first place.
2. Avoid trusting the integrity of any application code or configuration files on the compromised server; they may have been modified via the shell.

References & External Analysis

• Search "adodb" on VirusTotal (External Analysis)

Frequently Asked Questions

Related Families (Category: backdoor)

Explore other malware families in the same category:

• Houndhack
• Darkhotel
• Bagle
• Shutdowner
• Shadowhammer

Machine-readable

Get this profile as JSON: https://jordanricky1604-ship-it.github.io/malware-families-catalog/api/adodb.json

Ecosystem & Interactive Environments

This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.