Backdoor.PHP.WEBSHELL.SBJKXR

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Ejecuta comandos desde un usuario remoto malicioso que pone en peligro el sistema afectado.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Rutina de puerta trasera

Ejecuta los comandos siguientes desde un usuario remoto malicioso:

• List directory
• Find index.php in current directory
• Find config.php in current directory
• Show active connection
• Show running services
• Show user accounts
• Show computer name
• Show ARP table
• Show IP Configuration
• Infect webserver
• Execute PHP code
• Execute arbitrary commands
• Execute specific command line commands
• Execute SQL Commands
• Download/Upload Files
• Manage Files(Create directory, Change directory, Create, Read, Move, Copy , Archive)
• String Conversion
• FTP Brute force
• Bind port
• Delete itself
• Search for hash

Robo de información

Recopila los siguientes datos:

• Server Security Information
  • Server software
  • Loaded Apache modules
  • Disabled PHP Functions
  • cURL support
  • Supported databases
• OS Version
• OS build number
• User Accounts
• Account Settings
• Datetime
• HDD Disk space
• Current Working Directory
• Server IP
• Client IP
• Available Drives