PUA.PHP.AFoxTest.A

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Führt Befehle eines externen, böswilligen Benutzers aus, wodurch das betroffene System gefährdet wird.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Installation

Schleust die folgenden Dateien ein:

• {Malware file path}\{Random}.php

Backdoor-Routine

Führt die folgenden Befehle eines externen, böswilligen Benutzers aus:

• Manage file system (create file, read file, query file, move file, delete file, create directory)
• Execute arbitrary commands (shell commands, PHP commands)
• Gain root access through Dirty Cow exploit
• Manage database
• Zip/unzip files
• Upload files
• Get user credentials
• Reset cPanel passwords
• Create SMTP/RDP/mailer
• Brute-force FTP credentials
• Bind port to shell
• Change backconnect configuration
• Remove self
• Deface index files
• Configure redirects

Download-Routine

Öffnet die folgenden Websites, um Dateien herunterzuladen:

• https://www.{BLOCKED}r.org/version/?current={Version}
• https://raw.githubusercontent.com/{BLOCKED}ox-com/0/main/leafmailer2.8.php

Speichert die heruntergeladenen Dateien unter den folgenden Namen:

• {Malware file path}\adminer-{Random}.php
• {Malware file path}\mailer-{Random}.php

Datendiebstahl

Sammelt bei Ausführung der betroffenen Anwendung die folgenden Informationen:

• Username
• User account information
• Memory information (actual size, size of free space)
• Server information (loaded modules, phpinfo, server software, account settings)
• Current working directory and permissions
• Drives
• Operating system information
• IP address