PHP_SIMPLESHELL.H
Backdoor:PHP/SimpleShell.A (Microsoft)
Windows,Linux
![](/vinfo/imgFiles/legend.jpg)
Threat Type: Backdoor
Destructiveness: No
Encrypted: Yes
In the wild: Yes
OVERVIEW
This malware may be uploaded and installed on a web server by a remote malicious user after gaining access to the server.
Once this PHP script is installed, the remote user may then launch a backdoor on the affected system. Opening the page, the malicious user is shown a user interface.
This backdoor does not have any propagation routine.
It executes commands from a remote malicious user, effectively compromising the affected system.
It uses a user interface (UI).
TECHNICAL DETAILS
Arrival Details
This malware arrives via the following means:
- May be uploaded and installed/hosted on a web server by a remote malicious user after gaining access to the server
- May arrive on a web server as a file dropped by other malware or as a file downloaded unknowingly by users when visiting malicious sites.
Propagation
This backdoor does not have any propagation routine.
Backdoor Routine
This backdoor executes the following commands from a remote malicious user:
- Perform arbitrary remote shell commands (Prints output to browser if applicable)
- Upload arbitrary files to the server
- Create or Modify .htacccess file to the following configuration:
- Rename itself to {web server root directory}\info.php
Dropping Routine
This backdoor drops the following files:
- {web server root directory}\wp-indeks.php <- detected as PHP_SIMPLESHELL.HA
(Note: Can be accessed separately on another browser tab or window)
Information Theft
This backdoor gathers the following data:
- web server safe_mode status
- web host URL
- web host server address
- remote user server address
Stolen Information
This backdoor sends the data it gathers to the following email addresses via SMTP:
- {BLOCKED}ina_1@yahoo.com
Other Details
This backdoor uses the following user interface:
NOTES:
It does not have rootkit capabilities.
It does not exploit any vulnerability.
SOLUTION
Step 1
Before doing any scans, Windows XP, Windows Vista, and Windows 7 users must disable System Restore to allow full scanning of their computers.
Step 2
Note that not all files, folders, and registry keys and entries are installed on your computer during this malware's/spyware's/grayware's execution. This may be due to incomplete installation or other operating system conditions. If you do not find the same files/folders/registry information, please proceed to the next step.
Step 3
Remove malware/grayware files dropped/downloaded by PHP_SIMPLESHELL.H. (Note: Please skip this step if the threats listed below have already been removed.)
- PHP_SIMPLESHELL.HA
Step 4
Scan your computer with your Trend Micro product to delete files detected as PHP_SIMPLESHELL.H. If the detected files have already been cleaned, deleted, or quarantined by your Trend Micro product, no further step is required. You may opt to simply delete the quarantined files. Please check this Knowledge Base page for more information.
Step 5
Restore this file from backup only Microsoft-related files will be restored. If this malware/grayware also deleted files related to programs that are not from Microsoft, please reinstall those programs on you computer again.
- Modified .htaccess file
Did this description help? Tell us how we did.