0

I'm helping a non-profit and they have had malware on their WordPress site. I installed Sucuri and it quickly finds some strangely named HTML files in the base directory. I removed those files. Because of the malware found, the non-profit was blacklisted on 3 different spam sites (mxlookup search). I had updated all of their plugins, WordPress software, themes. I had removed unused themes and removed other users. They finally got off of the blacklists, but then today Sucuri found another malware file.

The file is always in the base wordpress directory and named with random characters (e.g., QPez2ejsEdss.html) and the contents is this:

<meta http-equiv="refresh" content="0;http://SOME_STRANGE_WEBSITE/">

Where SOME_STRANGE_WEBSITE is clearly a bad website.

What tools can I use to find the dropper of the malware?

2
  • There are simply too many ways for someone to have done this. You need someone who can analyse the site.
    – schroeder
    Commented Jan 16, 2021 at 20:19
  • Again, because there are so many ways to do this, there are so many different tools to try to find how it was done ...
    – schroeder
    Commented Jan 16, 2021 at 20:28

1 Answer 1

1

Is it a Windows server or Linux ?

Did you run an AV scan to see if the server is not infected ? What's the open ports situation ?

Since it's a web server , do see any strange open ports besides ports 80,443

Temporary solution

You could run a script to scan wordpress directory and delete malicious files while logging it

#!/bin/bash

now=$(date)

while :
do

  counter=$(grep -rnw '/var/www/wordpress/' -e 'SOME_STRANGE_WEBSITE' | wc -l)
  if [ $counter -gt 0 ]
    then
      echo "Found $counter malicious files on scan runned at $now" >> /home/no_root_user/log.txt
      ADD YOU LINE TO DELETE THE FILE EVENTUALLY HERE
    fi

  sleep 5
done
3
  • 2
    It is unlikely to be a malware infection or a vulnerable other service. The most common situation is a vulnerable plug-in, a weak password, or a vulnerability in a form or custom code.
    – schroeder
    Commented Jan 16, 2021 at 21:25
  • It's actually running on WPEngine (hosting provider). Not sure if they are windows or Linux. I've asked them to run a scan, but not sure if that will show the causing factor. I have updated all plugins before this last malware symptom. Commented Jan 16, 2021 at 21:39
  • 1
    @ArthurFrankel What you could also do DENY all traffic incoming/outgoing to IP http://SOME_STRANGE_WEBSITE/ using IPTable or firewall-cmd utility. But this, along with the logging script I provided, would be temporary until you figure out the real problem. I believe it might be related to a weak config or vulnerable custom code somehow as schroeder said
    – tom johnes
    Commented Jan 16, 2021 at 22:36

Not the answer you're looking for? Browse other questions tagged .