PHP Malware in index.php

Technical Analysis

During the investigation, I’ve found that the malware was injected into the index.php file of the client’s site. The PHP code includes obfuscated logic and malicious payload execution.

The malware makes use of a class TokensDeGuards that seems to deal with cryptographic operations but ultimately leads to executing an eval() on a highly obfuscated message derived from gzinflate(). The obfuscated code fragment is:

$handleVsMessage = gzinflate($payload);
if ($handleVsMessage === false) {
    throw new PayloadCodecsException('gzinflate failed (corrupted).');
}
eval($handleVsMessage);

The presence of eval() is particularly alarming, as it allows for arbitrary PHP code execution, which can be further manipulated from an external source or via the payload itself.

VirusTotal Analysis: 🛡️ Zero-Day / Fully Undetected.

Attack Chain

1. Detect malicious behavior
2. Identified unwanted text in search results
3. Analyzed index.php
4. Discovered obfuscated code
5. Class tokens handle suspicious cryptographic operations
6. Eval executes arbitrary code

Code Signature(s)

FILE: index.php

Analysis: Executes arbitrary code after inflating compressed malicious payload.

eval($handleVsMessage);

Indicators of Compromise (IOCs)

• stremoval[.]com

Removal Protocol

1. Remove obfuscated code from index.php
2. Revert to a previous clean version
3. Update CMS and plugins
4. Ensure file permissions are correctly set
5. Conduct a thorough review of other files for similar patterns

Status: Active Threat.
Verification: Verified by MD Pabel.