VirusTotal doesn't detect the backdoor

L

lck1115

Newbie
Joined
Dec 24, 2010
Messages
25
Reaction score
11
I installed a new wordpress and used a nulled theme which downloaded from weaplay.
Hours later I found my sever CPU and RAM were full 100%, all the time. (there are 8 CPUs and 32G RAM of my server)

After VirusTotal scanned the theme, there was a coinminer backdoor detected by Microsoft.
However, today I reanalyzed the zip theme, the same file. I am shocked to find that "No security vendors flagged this file as malicious".
Backdoor was gone.

https://www.virustotal.com/gui/file/f8ab5252d8ccf9be9b7c4766a2c4119bba408e5ba1320d5293a770d8e04e1676

The same file but different result.
I'm confused.
I'm quite sure there must be backdoors for the theme. But why VT dosen't deted it now??
 
Advertise on BHW
Try others like metadefender, hybrid-analysis and post here the results.
 
Most probably, that malware creator team noticed that their malware is being detected as malware by some anit-malware and then that malware creator team quickly patched (coded) their malware again in a way that it again no longer gets detected as malware. The coders creating malware nowadays are (smart business minded & profit minded people), way smarter than the coders working in big software companies outsourcing projects to 3rd world countries like mine (India) where salaried lazy slaves with no goals in life & outdated knowledge, handle the coding.
 
Last edited:
Don't do it just buy the theme or there is a guy here with a good vault with a lot of premium themes that goes for a price of a beer. VT had me hacked so many times because I trusted their results.
 
Well, this is scary, I want to hear the real experts on this.

I noticed once of this problem too, but still installed later lol, I hope my website is good now...

In your case, it seems not a false positive, this is a real shit, if virustotal can't be trusted, then no nulled or cracked thing can be used anymore.
 
Correct me if I'm wrong but VT only focuses on signature-based attacks right?

That means there could be a malicious script embedded on the file where it will only bring the coinminer payload once it establishes persistence on the machine.

In essence, the coinminer payload is not yet on the file that you scanned at VT.
 
Starblazer said:
I've written a guide to check Malware and Spoofed codes. You can check it here:
https://www.blackhatworld.com/seo/g...ed-plugins-spoofed-codes-and-attacks.1349575/
Click to expand...
No offence but only scanning for base64_decode and wp_vcd won’t be much of a help when it comes to detecting malicious scripts. A simple way to fool you would be
https://www.blackhatworld.com/seo/p...-for-detecting-malicious-web-scripts.1055564/

Perhaps do some more research on it. You are getting good at it. ;)
 
VT does not guarantee it. I faced it 2 times. I stopped using nulled theme now
 
Gogol said:
No offence but only scanning for base64_decode and wp_vcd won’t be much of a help when it comes to detecting malicious scripts. A simple way to fool you would be
https://www.blackhatworld.com/seo/p...-for-detecting-malicious-web-scripts.1055564/

Perhaps do some more research on it. You are getting good at it. ;)
Click to expand...
The commands are to find obfuscated codes which bypass detection. You can check recently modified files in Wordfence to see if people upload files through backdoor vulnerabilities.
 
lck1115 said:
I installed a new wordpress and used a nulled theme which downloaded from weaplay.
Hours later I found my sever CPU and RAM were full 100%, all the time. (there are 8 CPUs and 32G RAM of my server)

After VirusTotal scanned the theme, there was a coinminer backdoor detected by Microsoft.
However, today I reanalyzed the zip theme, the same file. I am shocked to find that "No security vendors flagged this file as malicious".
Backdoor was gone.

https://www.virustotal.com/gui/file/f8ab5252d8ccf9be9b7c4766a2c4119bba408e5ba1320d5293a770d8e04e1676

The same file but different result.
I'm confused.
I'm quite sure there must be backdoors for the theme. But why VT dosen't deted it now??
Click to expand...
If i got this right, VT detected the backdoor via the Microsoft engine on the 1st run, on the 2nd try it didn't detect anything. Right?

The backdoor didn't go anywhere obviously. If you check the scan result, on the 2nd try the Microsoft engine reported a timeout, so it didn't scan the file. And because that was the only positive on the 1st run, there was no positive on the 2nd.

Not every engine works all the time, so keep that in mind.
 
Starblazer said:
You can check recently modified files in Wordfence to see if people upload files through backdoor vulnerabilities.
Click to expand...
I use this thing called git and SSH. I don't really need to check anything with yet another wp plugin. :D
That's not what I was talking about, anyway. What I said is there are other footprints that you will miss, if you just scan for those two functions. you won't be able to detect the backdoors.
 
Yeah i faced this problem with nulled themes too that's more complicate when it start after a while and You not sure if you added something new or not.
 
I remembered Wordfence has an option that can disable upload to /upload directory or what I forgot it, in this case, will it stop the backdoor go into effect?
 
terrycody said:
I remembered Wordfence has an option that can disable upload to /upload directory or what I forgot it, in this case, will it stop the backdoor go into effect?
Click to expand...
Not sure how wordfence achieves that but if it blacklists extensions like php, php5 etc; it is a good thing. It could also help to disable script execution inside wp-content/uploads. ;)

However though, the backdoor may choose to upload the file somewhere else like wp-includes for example.
 
Advertise on BHW
You must log in or register to reply here.
Sign up now!

Main Menu

Home Main Forum List Black Hat SEO White Hat SEO BHW Newbie Guide Blogging Black Hat Tools Social Media Downloads

Marketplace

Account Selling Content / Copywriting EBooks / Methods Hosting Misc Proxies For Sale SEO - Link building SEO - Packages Social Media Social Media - Panels Web Design More

Making Money

Affiliate Programs Hire a Freelancer IM Journeys Making Money Pay Per Click Site Flipping Want to Buy

BlackHat World

Dispute Resolution Forum Suggestions & Feedback Introductions Lounge
Back
Top