fox-it/cryptophp

CryptoPHP Indicators of Compromise

CryptoPHP Indicators of Compromise

This repository contains the indicators of compromise for the CryptoPHP backdoor.

The whitepaper regarding CryptoPHP can be found here:

• http://blog.fox-it.com/2014/11/18/cryptophp-analysis-of-a-hidden-threat-inside-popular-content-management-systems/

Available IOCs

filename	description
file_hashes.csv	Contains the MD5 and SHA1 hashes of the different versions of the backdoor and when they were first seen
domains.txt	Contains the C2 domains used by the backdoor
ips.txt	Contains the C2 ip addresses used by the backdoor
email_addresses.txt	Contains the email addresses used as backup communication by the backdoor

Available scripts

We created some Python scripts to help administrators identify CryptoPHP:

https://github.com/fox-it/cryptophp/tree/master/scripts

cryptophp's Issues

Hash

b4b2c193f8af66b093ce1f1d284406a5

Following hash was the only hash found across multiple servers that was not on your list.

3 To 4 Domains Stuck Using check_url.py

Hi,
I have 3 to 4 domains stuck when checking with check_url.py.
Example ./check_url.py --verbose http://unisoftwares.com/index.php
When it stuck, it take to much load on cpanel server.

error when executing the script check_url.py

Hello,

when running the ./check_url.py i got this:

./check_url.py: line 5: `'
-bash: !DOCTYPE: event not found

thanks

SyntaxError: invalid syntax

./check_filesystem.py: línea 5: error sintáctico cerca del elemento inesperado newline' ./check_filesystem.py: línea 5:'
./check_url.py: línea 5: error sintáctico cerca del elemento inesperado newline' ./check_url.py: línea 5:'

Translation: SyntaxError: invalid syntax because of `'
I have no idea how to proceed here, can you please help me? thank you.

php version?

imho, most shared hosting do not provide python or shell to execute the command.
maybe better have php version that can be executed from browser.
thanks.

File samples

Is it possible that you also add/publish/send me file samples for all versions, for further detection scripts writing?

For example I would like to integrate more heuristic scan in my opensource Joomla/Wordpress antimalware script JAMSS https://github.com/btoplak/Joomla-Anti-Malware-Scan-Script--JAMSS- For heuristics approach I need source file to write a RegEx pattern to match on possible future iterations of this script, without relying on known file hash fingerprints.

Thanks!