Malware Signatures

  1. Home
  2. Malware Signatures
  3. pl.backdoor.shellbot.001

pl.backdoor.shellbot.001

Backdoors are server-side malicious scripts which are intended to perpetrate malicious acccess to the server. The typical example of such backdoors are various File Managers, Web Shells, tools for bypassing admin login or various one-purpose scripts allowing the attacker to upload and run another type of malicious scripts. The payload is PHP based, thus intended for server-side use and the payload is executed directly on the server, while the site is loaded. Only the payload result (such as Web Shell environment) is visible in the browser, not the malicious code itself. It's very common, that backdoors don't have any visible signs in the site code and it's impossible to detect them by accessing the infected site from outside. Server level analysis is necessary in case of infection by this type of malware.
This perl script is a IRC bot, it connects to a IRC server and accept commands from the Command & Control server. This kind of malware is what turn the computers into zombies, the botnet clients, sending spam, DDoS attacks and acting as a proxy for their owners to attack other servers.

Affecting

Any vulnerable website with perl support. Outdated software or compromised passwords can act as an infection vector.

Cleanup

Inspect your server looking for any unknown perl file and remove them. Also, you can sign up with us and let our team remove the malware for you.

Dump


#####################
# Stealth Shellbot #
#####################

sub getnick {
return "BTF".int(rand(1000));
}

sub getident2 {
my $length=shift;
$length = 3 if ($length < 3);

my @chars=('a'..'z','A'..'Z','1'..'9');
foreach (1..$length)
{
$randomstring.=$chars[rand @chars];
}
return $randomstring;
}

#############################
# B0tchZ na veia ehehe :P #
#############################