Backdoor.PHP.WEBSHELL.Y

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

It does not have any propagation routine.

It executes commands from a remote malicious user, effectively compromising the affected system.

It does not have any information-stealing capability.

Arrival Details

This Backdoor arrives on a system as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.

Propagation

This Backdoor does not have any propagation routine.

Backdoor Routine

This Backdoor executes the following commands from a remote malicious user:

• Execute arbitrary PHP codes

Rootkit Capabilities

This Backdoor does not have rootkit capabilities.

Information Theft

This Backdoor does not have any information-stealing capability.

Other Details

This Backdoor does the following:

• It can upload files on the compromised web server by checking for the parameter "Fox=efjiq" through HTTP GET request.
• It receives the arbitrary PHP code from the attacker through HTTP GET request using the parameter "php={URL of PHP script}".

It does not exploit any vulnerability.

It requires being hosted on a web server in order to proceed with its intended routine.