Backdoor.PHP.WEBSHELL.SBJSRMTZR

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Führt Befehle eines externen, böswilligen Benutzers aus, wodurch das betroffene System gefährdet wird.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Backdoor-Routine

Führt die folgenden Befehle eines externen, böswilligen Benutzers aus:

• Find index.php in current directory
• Find config.php in current directory
• Show active connection
• Show running services
• Show user accounts
• Show computer name
• Show ARP table
• Show IP Configuration
• Execute PHP Code
• Execute Arbitrary Code
• Manage Files (Change Access Permissions, Delete, Copy, Rename, Move, Read and Execute Files)
• Extract Zip Files
• Archive Files
• Upload/Download Files
• Display Current Working Directory
• Display Available Drives
• Create Files and Directories
• String Conversion
• Hash Searching
• Bruteforce Passwords (FTP, MySQL, PostgreSql)
• Connects to Specified Database
• Bind Port
• Delete Itself

Datendiebstahl

Folgende Daten werden gesammelt:

• Username
• Computer Name
• PHP Information
• OS Description
• Server Security Information
  • Server Software
  • Loaded Apached Modules
  • Disabled PHP Functions
  • cURL Support
  • Password Age
  • Minimum Password Length
  • Computer Role
  • User Accounts