A type of backdoor—one without an actual malware file—that has been wreaking havoc on WordPress sites recently

We will explain a type of backdoor—one that lacks a main malware component—which has been running rampant on WordPress recently (and for which we have confirmed a large number of infections).

Characteristics of the Malware

A key characteristic of this malware is that it contains code that retrieves the server’s temporary folders in various ways, in no particular order, as listed below.

“/tmp”
getenv(“TMP”)
getcwd()
sys_get_temp_dir()
“/var/tmp”
session_save_path()
“/dev/shm”
ini_get(“upload_tmp_dir”)
getenv(“TEMP”)

Upon analyzing the code, we find that this malware is designed to execute malicious code following the sequence described above.

・Retrieve the temporary data storage folder (here, the TMP folder)

・Decrypt the encrypted malicious code sent as POST data character by character using `chr(ord)`, shifting the characters and changing their character encodings each time to obfuscate it further.

*This process is believed to be intended to make it easier to evade malware detection during network communication.

・Writes the decrypted malicious code to the TMP folder.

・Includes (internally loads) that code and executes the main body of the malicious code.

・Although the main body of the malicious code in the TMP folder is deleted, it continues to run in memory because it has already been included.

What makes this malware particularly troublesome is that the malicious code itself is immediately deleted from the server. As a result, the main body of the malicious code goes undetected, and it becomes impossible to verify later what actions the hacker took on the server.

This type of malicious code often infects even the code within legitimate files deep within WordPress, making it difficult to manually inspect and remove each file one by one.

WP Doctor has recently added a large number of this type of malware pattern to its [Free] WordPress: Malware Scan & Security Plugin [Malware & Virus Detection and Removal]
We have recently added a large number of malware patterns for this type of malware, so please feel free to use it.
(Although the free version of the plugin can scan for and remove malware, please consider using the paid version when detecting malware using the latest patterns that have been added very recently.)