Backdoor.PHP.DEWMODE.A

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. Diese Malware kann auf verschiedenste Weise übertragen werden.

Führt Befehle eines externen, böswilligen Benutzers aus, wodurch das betroffene System gefährdet wird.

Übertragungsdetails

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Die Übertragung kann wie folgt erfolgen:

• It may be delivered by exploiting the following vulnerabilities:
  • CVE-2021-27101
  • CVE-2021-27102
  • CVE-2021-27103
  • CVE-2021-27104

Backdoor-Routine

Führt die folgenden Befehle eines externen, böswilligen Benutzers aus:

• Download files from victim server
• Delete traces in the system

Einschleusungsroutine

Schleust die folgenden Dateien ein:

• /tmp/.scr → temporary file used to delete traces of the malware when requested by the C&C; deleted afterwards.
• /tmp/.out → temporary file used to redirect logging of malware trace deletion; deleted afterwards.

Andere Details

Es macht Folgendes:

• Once accessed, it will display the list of files existing in the SQL database hosted in the target server
  
• It displays the following if no files are present in the database:
  
• It uses the dropped file /tmp/.scr to delete traces of itself in the server. This dropped file does the following:
  • Remove the line referencing the malware in all of the logs located in "/var/opt/apache".
  • Overwrite the contents of adminpl.log with blanks.
  • Delete malware trace in the machine.
  • Overwrite /var/log/secure with blanks.