PHP_SIMPLESHELL.H

This malware may be uploaded and installed on a web server by a remote malicious user after gaining access to the server.

Once this PHP script is installed, the remote user may then launch a backdoor on the affected system. Opening the page, the malicious user is shown a user interface.

This backdoor does not have any propagation routine.

It executes commands from a remote malicious user, effectively compromising the affected system.

It uses a user interface (UI).

Arrival Details

This malware arrives via the following means:

• May be uploaded and installed/hosted on a web server by a remote malicious user after gaining access to the server
• May arrive on a web server as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Propagation

This backdoor does not have any propagation routine.

Backdoor Routine

This backdoor executes the following commands from a remote malicious user:

• Perform arbitrary remote shell commands (Prints output to browser if applicable)
• Upload arbitrary files to the server
• Create or Modify .htacccess file to the following configuration:
  • 
• Rename itself to {web server root directory}\info.php

Dropping Routine

This backdoor drops the following files:

• {web server root directory}\wp-indeks.php <- detected as PHP_SIMPLESHELL.HA
  (Note: Can be accessed separately on another browser tab or window)

Information Theft

This backdoor gathers the following data:

• web server safe_mode status
• web host URL
• web host server address
• remote user server address

Stolen Information

This backdoor sends the data it gathers to the following email addresses via SMTP:

• {BLOCKED}ina_1@yahoo.com

Other Details

This backdoor uses the following user interface:

NOTES:

It does not have rootkit capabilities.

It does not exploit any vulnerability.