Skip to content

31.184.234.60-2017-12-28a

Directory actions

More options

Directory actions

More options

Latest commit

 

History

History

31.184.234.60-2017-12-28a

README.md

Test of malware installation

Origin

IP Address 31.184.234.60

Download

Decoding

  1. Hand edit 31.184.234.60WkS-UWj-hr9ZQfNqRyVLAgAAAAQ.php.file into dropper.php
  2. Execute php dropper.php which yields avFQkFVHq6.html

Analysis

Here's the entirety of avFQkFVHq6.html:

<head>
<meta name="description" content="ok file uploaded">
<meta http-equiv="refresh" content="0;URL=http://datinginfo.info"/>
</head>

Someone did try to access that file:

31.184.234.60 - - [28/Dec/2017:02:54:26 -0700] "GET /wordpress/wp-content/plugins/revslider/temp/update_extract/revslider/avFQkFVHq6.html HTTP/1.1" 404 1006 "-" "Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/48.0.2564.109 Safari/537.36"

Conveniently, the IP address that downloaded the dropper, tried to access the HTML file.

This just verifies that PHP can be downloaded, the dropper executed, and the resulting HTML accessed. At a guess, once those factors are verified, more malware gets downloaded, or maybe the WordPress can be considered owned, and sold on the black market.