33

Recently my php-based website got infected with malware (probably by a stolen ftp password).
Basically, every 30 minutes a file frame_cleaner_php.php was uploaded, a HTTP-GET was done on it to execute it and it was removed. I was able to intercept a copy of the file and analyze it.

It was not obfuscated in any way and was quite easy to read.
In essence it recursively scanned all php-files, looked for 20 signatures of infections by common other malware (like <?php eval(base64_decode(" or <?PHP # Web Shell by oRb) and crudely removed the lines with that infection.

Because of a false positive some lines in my own php files where removed causing the site the go down. This was probably just an unintended side effect of the malware.

The big question: why would malware do this, what is there to gain?

Improve this question
6
  • 11
    Response to first sentence: Switch to sftp.
    – Iszi
    Commented Mar 11, 2012 at 15:58
  • 1
    sftp would help against password sniffing on the line. However I have reason to believe that a virus on my computer has found stored ftp-passwords that I had not encrypted at the time.
    – Jeff
    Commented Mar 11, 2012 at 19:40
  • @Jeff - Those passwords are likely stored unencrypted. Your password was either to easy or you have malware on the computer you access the ftp account from.
    – Ramhound
    Commented Mar 12, 2012 at 12:11
  • 3
    hmm it looks that corewars evolved :)
    – Piotr Czapla
    Commented Mar 14, 2012 at 6:48
  • 1
    Does the removing program qualify as "malware" if it's removing malware?
    – Bruce Ediger
    Commented Mar 18, 2015 at 18:45

6 Answers 6

Reset to default
36

There is two explanations as I see it.

Fight over the box

The different malware types want to single-handedly own the box and not share it with others. It will therefore try to patch the system and remove other malware and leave a backdoor for the creator.

Ethical worms

Malware that spreads only to patch and remove other malware is often referred to as "white worms" or "ethical worms". These types of worms have very many liability issues so they are rarely seen.

2022.04.17 edit:

Anti-Forensics, Anti Reverse-Engineering

Malware could also be misplaced on a system. Infected by accident, the attackers would want to remove it to prevent analysis.

Improve this answer
6
  • 13
    Ethical Worms, interesting, never heard bout them. +1
    – Marek Sebera
    Commented Mar 11, 2012 at 10:07
  • 8
    It is sometimes suggested that having your PC owned by the "Cybermaffia" gives you the best antivirus there is, as they know the playing field and, indeed, do not want to share the box with others. Of course, this probably also means that you are a node in a botnet or something equally unfavorable.
    – Legolas
    Commented Mar 11, 2012 at 12:30
  • 9
    Another reason is that malware that spreads via remote exploits (e.g. a BoF in a protocol such as SMB) would just continually infect the target machine over and over. Repeated infections may cause problems and alert the user. Some malware gets around this by advertising that the box is infected, but it's a sure-fire way to get detected, so patching the machine is often the best choice for malware writers.
    – Polynomial
    Commented Mar 11, 2012 at 12:43
  • 1
    @MarekSebera Nachi (aka Welchia) was one example.
    – kinokijuf
    Commented Mar 11, 2012 at 13:42
  • 8
    Ethical worms eh? Sort of the Dark Knight of hackers? :) Someone should make a movie about it.
    – Qw4z1
    Commented Mar 11, 2012 at 14:43
28

Extending Karrax's answer:

Because the more infections a box has, the higher the chanches (at least one of) the infection gets caught are, and if the box is wiped / cleaned up, it's game over for the malware.

So, by cleaning up other infections and/or patching the system the malware is trying to preserve its own existence.

Improve this answer
2
  • 4
    Funny thing is that because of the (badly executed) cleaning I discovered the infection in the first place.
    – Jeff
    Commented Mar 14, 2012 at 18:47
  • @Jeff, Why does it use GET to execute the script instead of simply executing it directly on the server?
    – Pacerier
    Commented Mar 28, 2015 at 17:14
12

Some malware authors are part of groups that don't like other malware authors. It's kind of like one football team which doesn't like another football team; they both want to see furtherance of football, but they don't want that other team to be there when it happens.

Improve this answer
1
  • 6
    This is more true than it might seem at first. See Brian Krebs' Pharma Wars series. Botnets are mostly chosen and rented based on their size. Anything you can do to lower your competitor's botnet's size helps make you richer.
    – Ladadadada
    Commented Mar 11, 2012 at 21:23
11

Some good answers here, I hope I can add to them.

To understand why, you have to realise that your infected web server has a monetary value to the person that infected it. It may be rented out for all manner of activity from routing traffic, hosting other sites, distributing spam, DDoS, etc.

If the server has multiple infections it means it is being shared, it could be being used by one person to host malware but another may be using it to carry out distributed denial of service attacks (DDoS) attacks. If one of these guys gets the IP blacklisted then it is useless for the other.

Further to this, removing vulnerabilities and other malware from the box happens so you either remove others or they remove you and you lose control of the box.

Improve this answer
8

Criminal hacker groups just don't like sharing the wealth with each other. If it's interfering with your income stream, you want it out of the running, so you disable it. Plus, security-wise, if you're running a botnet, do you want another botnet having access to gleaning information on your tactics?

Operational security, it's not just for honest people only...

Improve this answer
-1

For the same reason that gangs are fighting with members of other gangs in order to remove them from the street. It is about securing the exclusive control of the valuable resources, whether it is the businesses on the street, or the CPU/GPU power.

Improve this answer
1
  • 2
    That answer doesn't add any information to already existing answers.
    – user163495
    Commented Apr 15, 2022 at 0:04

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .