PHP_EXPLOYT.GES

This Trojan arrives as a component bundled with malware/grayware packages. It may be hosted on a website and run when a user accesses the said website.

It requires its main component to successfully perform its intended routine. It takes advantage of certain vulnerabilities.

Arrival Details

This Trojan arrives as a component bundled with malware/grayware packages.

It may be hosted on a website and run when a user accesses the said website.

Other Details

This Trojan requires its main component to successfully perform its intended routine.

It requires the existence of the following files to properly run:

• lspinq/d390f.js
• lspinq/57ee0.js

More information on this vulnerability can be found below:

• CVE-2013-3918

It takes advantage of the following vulnerabilities:

• (MS13-090) Cumulative Security Update of ActiveX Kill Bits (2900986)

NOTES:

It creates an iframe or redirects to certain URLs depending on the parameter it receives.

It may redirect to the following URL:

• {malware’s host}/{malware’s URL path}/nhopee.php

The iframe consists any of the following URLs that is appended to the current URL:

• {malware's host}/{malware's URL path}/bgamesn.php
• {malware's host}/{malware's URL path}/sboheld php - detected also as PHP_EXPLOYT.GES
• {malware's host}/{malware's URL path}/kbadq.php
• {malware's host}/{malware's URL path}/ssaidu.php
• {malware's host}/{malware's URL path}/ibattestinj.php
• {malware's host}/{malware's URL path}/stensiond.php
• {malware's host}/{malware's URL path}/qaheadk.php
• {malware's host}/{malware's URL path}/dcontrollingk.php
• {malware's host}/{malware's URL path}/jmoralm.php

{malware’s host}/{malware’s URL path}/sboheld.php uses the said exploit to execute arbitrary code depending on the existing object in the host site.

However, as of this writing, the said sites are inaccessible.