ThreatFox IOC Database

Efrain

PHP webshell kit uploaded to WordPress via the wp-admin plugin installer, captured 2026-09-17 from 45.61.187.30 (AS53667, FranTech). Three files: a three-line index.php loader — error_reporting(0); ignore_user_abort(true); include('log.db') — the shell body hidden in log.db to evade scanners that only inspect .php, and a second archive whose index.php inserts an administrator named "adminlin" directly into wp_users, bypassing wp_insert_user() so the user_register hook never fires and audit-log plugins do not see the account appear. Execution is a GET on the plugin directory, since index.php is served as the directory index. Undetected by 61 AV engines, ClamAV and all YARAify community rules at time of capture; the dropper has been in circulation since ~2021. YARA rules deployed on YARAhub: WEBSHELL_PHP_gov_uploader and WEBSHELL_PHP_fake_cmsmap_plugin.