How does this backdoor work?

Question

I just found that one of my wordpress websites included backdoor (my guess).

As I see now, the same file on server is different than original on my laptop drive. So I think my website is already infected. Can you help me clean that up?

Sorry I can't put the code here as I am new and code is big and don't know how to import. You can see it here: Backdoor

Any Help Appreciated!!!

Answer 1

This is knows as Wp-vcd Malware. For full analysis you can check here.

For hardening Wordpress check here, and if you ask yourself, what should you do when your website is hacked - click here.

For removing that particular malware follow this.

More from IBM X-Force Exchange:

Malicious code injection inside a wordpress theme's functions.php and wp-includes editing posts content.

Injected files:

wp-vcd.php
class.wp.php

Edited files:

functions.php
post.php

Analysis

https://medium.com/@cirku17/wp-vcd-malware-analysis-7c5dbaad89c3

Repository

https://github.com/CirKu17/wp-vcd-malware-sample

Keep in mind that this may be updated version of malware, so I didn't go through all the source - my suggestion for you is to backup your website and database from clean backups.