Malware restored on the server simply by accessing the WordPress site

We will explain the method of malware restoration on the server simply by accessing the WordPress site.

Why malware that has been removed on the server is automatically restored just by accessing the site

This type of malware is very common, and in many cases, the malware is parasitic and reinfects the program files that are executed whenever WordPress renders a site page on the system.

As an example, the files that WordPress always executes are the following files. (Other files deep within the system may also be infected)

index.php
wp-config.php
wp-blog-header.php
theme-functions.php

The figure below is a screenshot of an example of malware infecting index.php.

In order for WordPress to display the site, it reads require __DIR__ . ‘/wp-blog-header.php’; which WordPress loads to display the site, there is obfuscated malicious code that is executed each time the site is accessed.

I have tried to de-obfuscate this code in order to analyze it.
After repeating base64 decoding and de-obfuscation several times, the original bare code appeared.

We can see that the malware notifies a social networking site called Telegram that it is infected. It is likely that automated hacking tools are used to hack into a vast number of WordPress sites, and only successful sites are notified to Telegram, after which the hackers continue their attack.

Thus, malware very often contains Telegram.org links or URLs.

The following code shows a text file pulled from several URLs and executed with an eval function.

The eval function is a PHP function that interprets text as a program and executes it

Most likely the above site is another site that has been hacked by hackers. The malware body is placed on this site, and every time index.php is executed, the malware is pulled from other infected sites and reinfected.

Since this malware pulls and executes the malware body on an external server, its function can be changed at any time by hackers.

How to get rid of malware that reinfects itself automatically

To get rid of this type of malware,

index.php
wp-config.php
wp-blog-header.php
theme-functions.php

However, since other malware may be installed deep within WordPress, it is often not possible to remove the malware by simply removing the above files.

For this reason, you can detect and remove more malware by using a malware scanning and removal plug-in that mechanically and comprehensively scans WordPress files. (If you are unable to log in to your WordPress site, the HTACCESSS file may have been tampered with.)