Backdoor.PHP.DEWMODE.A

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites. Este malware podría introducirse utilizando uno o varios métodos de entrada.

Ejecuta comandos desde un usuario remoto malicioso que pone en peligro el sistema afectado.

Detalles de entrada

It arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Entra a través de los siguientes medios:

• It may be delivered by exploiting the following vulnerabilities:
  • CVE-2021-27101
  • CVE-2021-27102
  • CVE-2021-27103
  • CVE-2021-27104

Rutina de puerta trasera

Ejecuta los comandos siguientes desde un usuario remoto malicioso:

• Download files from victim server
• Delete traces in the system

Rutina de infiltración

Infiltra los archivos siguientes:

• /tmp/.scr → temporary file used to delete traces of the malware when requested by the C&C; deleted afterwards.
• /tmp/.out → temporary file used to redirect logging of malware trace deletion; deleted afterwards.

Otros detalles

Hace lo siguiente:

• Once accessed, it will display the list of files existing in the SQL database hosted in the target server
  
• It displays the following if no files are present in the database:
  
• It uses the dropped file /tmp/.scr to delete traces of itself in the server. This dropped file does the following:
  • Remove the line referencing the malware in all of the logs located in "/var/opt/apache".
  • Overwrite the contents of adminpl.log with blanks.
  • Delete malware trace in the machine.
  • Overwrite /var/log/secure with blanks.