Malware hitting websites on AAPanel

szone

Hi,

I have two servers configured with AAPanel on different providers. Both of the servers have a different sets of websites. And there's a random words PHP file having 1.93 or 1.95KB file size, in each website's directory.

Upon scanning the files, it was found that it was malware. 95% of websites are wordpress based and have wordfence security plugin installed.

One server is on NGINX and also using NGINX free firewall, while the other one is on apache, both got infected.

What security measures should be taken to avoid the malware execution next time?

1vuvztpo.php - this 1.95KB file was found in each website directory, even though PHP session isolation was enabled too. https://www.virustotal.com/gui/file/371f016ed363f1a7038051ffe00fb751be5757b7deca10020aad375db2751090/detection

r7ntpn6vnx_index.php
https://www.virustotal.com/gui/file/6452039c95cf77d834e2eaa1459abf4e176c1f7158f2b86751138e5bd24e072e/detection

index.php
https://www.virustotal.com/gui/file/57e36224d5ae1681329850f97225cbbdc9952470e75b7b081c909139c3ecc00d/detection

v1sh4l

szone how did you scan?

JAY

szone
are you using any nulled scripts check, some one upload backdoor malware update all plugins and wordpress to latest versions dont use any nulled plugins

szone

This was due to File Manager plugin vulnerability in WordPress. 1.7 Million websites got the malware attack.

szone

v1sh4l Few websites got down, upon having a close look on files, I found there are irregular filenames. Random PHP files and index.php was renamed too. So I had a doubt of malware / hack attempt. Then I had restored previous backups and scanned the doubtful files with VirusTotal and immediately initiated wordfence scan, which has detected more files there. Cleaned them now!

sakthiwebdev

v1sh4l

Step 1
Deactivate all the plugins...
If you have no access to WordPress backend (getting an error) - Rename plugin folder in aapanel file explorer or ssh or ftp.

Step 2
Login to WordPress dashboard now & go to plugin page...you will see no plugin there. Now rename the plugin folder back to "plugins" through ftp.
All the plugin will be listed back as deactivated.
Update all plugins (must update - Flie Manager plugin)

Step 3
Scan with "Wordfence " DO all file repairs and removal need.

Finally, activate all plugins one by one...if you get any error after activating a plugin. Just rename that plugin folder alone. (replace the plugin with a new copy from official developers)

I hope this helps!

JAY

aapanel should add antivirus addon to scan php files.

szone

JAY There's no nulled theme or plugin being used. It was WordPress File Manager plugin vulnerability. Millons of websites have been attacked with malware due to that vulnerability.

JAY

szone
Solution
The File Manager plugin was updated to version 6.9 on September 1 to address this vulnerability by removing several elFinder library files from the plugin. WordPress users that use the File Manager plugin should upgrade to the latest version as soon as possible and scan for with antivirus plugin and remove malware flles

szone

JAY solution is to never keep such vulnerable plugins installed. I will prefer to use SFTP or AAPanel's file manager.

aaP_ptakx

We got infected also and we got everywhere files with aleatory names "QtnD8K" Trojan:Linux/Multiverze

Banned from OVH and accused of Phishing

Also an invisible file /index [.] html?iqbhbwgdvbefjnGVFXEreDCvygBYhbUni%7Cm%7CmIJnHUBGvTFCrEt*rdFTGVY

This virus is not casual and appears just when we started using aapanel.

Also, OVH accused us to:

-pass the native CentOS security
-create a phishing website
-create DNS record for a sub-domain
-send phishing mail
-make DDoS attacks (catch by VAC engine)

Obviously we didn't make no one of this actions so... FUCK MEN !!!

aaPanel need NOW an antivirus with active supervising.
I try Clamav but it's needed manual analysis. Any ideas about antivirus that can hace active file analizer?