Backdoor.PHP.WEBSHELL.SBJKXR

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Führt Befehle eines externen, böswilligen Benutzers aus, wodurch das betroffene System gefährdet wird.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Backdoor-Routine

Führt die folgenden Befehle eines externen, böswilligen Benutzers aus:

• List directory
• Find index.php in current directory
• Find config.php in current directory
• Show active connection
• Show running services
• Show user accounts
• Show computer name
• Show ARP table
• Show IP Configuration
• Infect webserver
• Execute PHP code
• Execute arbitrary commands
• Execute specific command line commands
• Execute SQL Commands
• Download/Upload Files
• Manage Files(Create directory, Change directory, Create, Read, Move, Copy , Archive)
• String Conversion
• FTP Brute force
• Bind port
• Delete itself
• Search for hash

Datendiebstahl

Folgende Daten werden gesammelt:

• Server Security Information
  • Server software
  • Loaded Apache modules
  • Disabled PHP Functions
  • cURL support
  • Supported databases
• OS Version
• OS build number
• User Accounts
• Account Settings
• Datetime
• HDD Disk space
• Current Working Directory
• Server IP
• Client IP
• Available Drives