VirusTotal doesn't detect the backdoor

[lck1115]

I installed a new wordpress and used a nulled theme which downloaded from weaplay.
Hours later I found my sever CPU and RAM were full 100%, all the time. (there are 8 CPUs and 32G RAM of my server)

After VirusTotal scanned the theme, there was a coinminer backdoor detected by Microsoft.
However, today I reanalyzed the zip theme, the same file. I am shocked to find that "No security vendors flagged this file as malicious".
Backdoor was gone.

https://www.virustotal.com/gui/file/f8ab5252d8ccf9be9b7c4766a2c4119bba408e5ba1320d5293a770d8e04e1676

The same file but different result.
I'm confused.
I'm quite sure there must be backdoors for the theme. But why VT dosen't deted it now??

 

[sujoydhar]

Thats true !
Virustotall is now a crap.

 

[lck1115]

Thats true !
Virustotall is now a crap.

Any lternatives suggest?

 

[TheVigilante]

Any lternatives suggest?

Scanning locally is your best bet or you can always research

 

[joney]

Try others like metadefender, hybrid-analysis and post here the results.

 

[pocketttt]

VT never fail to me

 

[Rollfic]

Never install nulled stuffs.

 

[Chris Newman]

Most probably, that malware creator team noticed that their malware is being detected as malware by some anit-malware and then that malware creator team quickly patched (coded) their malware again in a way that it again no longer gets detected as malware. The coders creating malware nowadays are (smart business minded & profit minded people), way smarter than the coders working in big software companies outsourcing projects to 3rd world countries like mine (India) where salaried lazy slaves with no goals in life & outdated knowledge, handle the coding.

 

[deShark]

Don't do it just buy the theme or there is a guy here with a good vault with a lot of premium themes that goes for a price of a beer. VT had me hacked so many times because I trusted their results.

 

[terrycody]

Well, this is scary, I want to hear the real experts on this.

I noticed once of this problem too, but still installed later lol, I hope my website is good now...

In your case, it seems not a false positive, this is a real shit, if virustotal can't be trusted, then no nulled or cracked thing can be used anymore.

 

[Naughtyfatkid]

Correct me if I'm wrong but VT only focuses on signature-based attacks right?

That means there could be a malicious script embedded on the file where it will only bring the coinminer payload once it establishes persistence on the machine.

In essence, the coinminer payload is not yet on the file that you scanned at VT.

 

[Starblazer]

I've written a guide to check Malware and Spoofed codes. You can check it here:
https://www.blackhatworld.com/seo/g...ed-plugins-spoofed-codes-and-attacks.1349575/

 

[Gogol]

I've written a guide to check Malware and Spoofed codes. You can check it here:
https://www.blackhatworld.com/seo/g...ed-plugins-spoofed-codes-and-attacks.1349575/

No offence but only scanning for base64_decode and wp_vcd won’t be much of a help when it comes to detecting malicious scripts. A simple way to fool you would be
https://www.blackhatworld.com/seo/p...-for-detecting-malicious-web-scripts.1055564/

Perhaps do some more research on it. You are getting good at it.

 

[itzmagic]

VT does not guarantee it. I faced it 2 times. I stopped using nulled theme now

 

[Starblazer]

No offence but only scanning for base64_decode and wp_vcd won’t be much of a help when it comes to detecting malicious scripts. A simple way to fool you would be
https://www.blackhatworld.com/seo/p...-for-detecting-malicious-web-scripts.1055564/

Perhaps do some more research on it. You are getting good at it.

The commands are to find obfuscated codes which bypass detection. You can check recently modified files in Wordfence to see if people upload files through backdoor vulnerabilities.

 

[HoNeYBiRD]

I installed a new wordpress and used a nulled theme which downloaded from weaplay.
Hours later I found my sever CPU and RAM were full 100%, all the time. (there are 8 CPUs and 32G RAM of my server)

After VirusTotal scanned the theme, there was a coinminer backdoor detected by Microsoft.
However, today I reanalyzed the zip theme, the same file. I am shocked to find that "No security vendors flagged this file as malicious".
Backdoor was gone.

https://www.virustotal.com/gui/file/f8ab5252d8ccf9be9b7c4766a2c4119bba408e5ba1320d5293a770d8e04e1676

The same file but different result.
I'm confused.
I'm quite sure there must be backdoors for the theme. But why VT dosen't deted it now??

If i got this right, VT detected the backdoor via the Microsoft engine on the 1st run, on the 2nd try it didn't detect anything. Right?

The backdoor didn't go anywhere obviously. If you check the scan result, on the 2nd try the Microsoft engine reported a timeout, so it didn't scan the file. And because that was the only positive on the 1st run, there was no positive on the 2nd.

Not every engine works all the time, so keep that in mind.

 

[Gogol]

You can check recently modified files in Wordfence to see if people upload files through backdoor vulnerabilities.

I use this thing called git and SSH. I don't really need to check anything with yet another wp plugin.
That's not what I was talking about, anyway. What I said is there are other footprints that you will miss, if you just scan for those two functions. you won't be able to detect the backdoors.

 

[Kamil Witakowski]

Yeah i faced this problem with nulled themes too that's more complicate when it start after a while and You not sure if you added something new or not.

 

[terrycody]

I remembered Wordfence has an option that can disable upload to /upload directory or what I forgot it, in this case, will it stop the backdoor go into effect?

 

[Gogol]

I remembered Wordfence has an option that can disable upload to /upload directory or what I forgot it, in this case, will it stop the backdoor go into effect?

Not sure how wordfence achieves that but if it blacklists extensions like php, php5 etc; it is a good thing. It could also help to disable script execution inside wp-content/uploads.

However though, the backdoor may choose to upload the file somewhere else like wp-includes for example.