Backdoor.PHP.DEFACER.B

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Führt Befehle eines externen, böswilligen Benutzers aus, wodurch das betroffene System gefährdet wird.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

Fügt die folgenden Ordner hinzu:

• If request parameter "getTools" is set and directory "/home/{username}/.cpanel" exists
  • /home/{username}/mail/{server name}/smtpfox-{random}
  • /home/{username}/mail/{server name}/smtpfox-{random}/.Archive
  • /home/{username}/mail/{server name}/smtpfox-{random}/.Drafts
  • /home/{username}/mail/{server name}/smtpfox-{random}/.Sent
  • /home/{username}/mail/{server name}/smtpfox-{random}/.spam
  • /home/{username}/mail/{server name}/smtpfox-{random}/.Trash
  • /home/{username}/mail/{server name}/smtpfox-{random}/cur
  • /home/{username}/mail/{server name}/smtpfox-{random}/new
  • /home/{username}/mail/{server name}/smtpfox-{random}/tmp

Schleust die folgenden Dateien ein:

• If request parameter "getTools" is set and directory "/home/{username}/.cpanel" exists
  • /home/{username}/mail/{server name}/smtpfox-{random}/dovecot-acl-list
  • /home/{username}/mail/{server name}/smtpfox-{random}/dovecot-uidlist
  • /home/{username}/mail/{server name}/smtpfox-{random}/dovecot-uidvalidity
  • /home/{username}/mail/{server name}/smtpfox-{random}/dovecot-uidvalidity.5e196afc
  • /home/{username}/mail/{server name}/smtpfox-{random}/dovecot.index.log
  • /home/{username}/mail/{server name}/smtpfox-{random}/dovecot.list.index.log
  • /home/{username}/mail/{server name}/smtpfox-{random}/dovecot.mailbox.log
  • /home/{username}/mail/{server name}/smtpfox-{random}/maildirsize
  • /home/{username}/mail/{server name}/smtpfox-{random}/subscriptions
• If request parameter "getTools" is set and directory "{document root dir}/wp-admin" exists:
  • {Document Root Directory}/wp-admin/php.ini
  • {Document Root Directory}/wp-includes/php.ini
  • {Document Root Directory}/wp-content/php.ini
  • {Document Root Directory}/wp-admin/.htaccess
  • {Document Root Directory}/wp-includes/.htaccess
  • {Document Root Directory}/wp-content/.htaccess
  • {Document Root Directory}/wp-includes/index.php
• Else If directory "{document root dir}/components" exists:
  • {Document Root Directory}/components/php.ini
  • {Document Root Directory}/administrator/php.ini
  • {Document Root Directory}/libraries/php.ini
  • {Document Root Directory}/components/.htaccess
  • {Document Root Directory}/administrator/.htaccess
  • {Document Root Directory}/libraries/.htaccess
• Else:
  • {Document Root Directory}/php.ini

Andere Systemänderungen

Ändert die folgenden Dateien:

• It rewrites the following cPanel files' email address:
  • /home/{username}/.contactemail
  • /home/{username}/.cpanel/contactinfo
• It appends created SMTP credentials:
  • /home/{username}/etc/{server name}/shadow
  • /home/{username}/etc/shadow

Backdoor-Routine

Führt die folgenden Befehle eines externen, böswilligen Benutzers aus:

• Replace cPanel email address
• Reset cPanel Password
• Download and drop tools
• Create email account

Download-Routine

Lädt die Datei von folgendem URL herunter und benennt sie um, wenn sie auf dem betroffenen System gespeichert wird:

• http://{BLOCKED}ousfox.to/files/olux-shell.txt
• http://{BLOCKED}ousfox.to/files/xleet-shell.txt
• http://{BLOCKED}ousfox.to/files/mailer.txt

Speichert die heruntergeladenen Dateien unter den folgenden Namen:

• If directory "{document root dir}/wp-admin" exists:
  • {Document Root Directory}/wp-admin/{random string}.php
  • {Document Root Directory}/wp-includes/{random string}.php
  • {Document Root Directory}/wp-content/{random string}.php
• Else If directory "{document root dir}/components" exists:
  • {Document Root Directory}/components/{random}.php
  • {Document Root Directory}/administrator/{random}.php
  • {Document Root Directory}/libraries/{random}.php
• Else:
  • {Document Root Directory}/{random string}.php
  • {Document Root Directory}/{random string}.php
  • {Document Root Directory}/{random string}.php