PHP_FLOOD.A

October 02, 2014

• Email
• Facebook
• 
  Twitter
• Google+
• Linkedin

 Analysis by: Anthony Joe Melgarejo

---

 ALIASES:

Troj/PHPFlood-A (Sophos)

 PLATFORM:

Linux, Unix

 OVERALL RISK RATING:

 DAMAGE POTENTIAL:

 DISTRIBUTION POTENTIAL:

 REPORTED INFECTION:

 INFORMATION EXPOSURE:

• 
  Threat Type: Trojan
• 
  Destructiveness: No
• 
  Encrypted: No
• 
  In the wild: Yes

  TECHNICAL DETAILS

File Size:

1298 bytes

File Type:

Script

Memory Resident:

No

Initial Samples Received Date:

01 Oct 2014

Payload:

Compromises system security

Arrival Details

This Trojan may be downloaded from the following remote sites:

• http://{BLOCKED}.{BLOCKED}.225.119/conf.txt

This malware arrives via the following means:

• CVE-2014-6271

NOTES:

It accepts the following parameters through HTTP GET:

• host
• port
• timeout
• password

It will use the parameters it receives to perform UDP flooding consisting of 65,000 random alphanumeric characters.

If no port is passed, it will randomly pick from ports 79 to 65,000.

It checks if the password is microstresser14.

  SOLUTION

Minimum Scan Engine:

9.700

FIRST VSAPI PATTERN FILE:

11.184.04

FIRST VSAPI PATTERN DATE:

01 Oct 2014

VSAPI OPR PATTERN File:

11.185.00

VSAPI OPR PATTERN Date:

02 Oct 2014

Scan your computer with your Trend Micro product to delete files detected as PHP_FLOOD.A. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.

Did this description help? Tell us how we did.