cadline_web/www_archline_hu
11
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
chore/remove-dev-cruft
www_archline_hu/malware-iocs.md
LÁZÁR Imre AI Agent e17c6268c5 docs: remove operator-internal (git.illusion.hu) references 
This repo lives on the customer Gitea (git.cadline.hu); drop references to the
operator's internal Gitea repos (audit/incident tracker, HIDS verifier) and
describe those generically instead.

Signed-off-by: LÁZÁR Imre <imre@illusion.hu>
Assisted-by: claude-code@claude-opus-4-8
2026-07-16 12:14:05 +02:00

2.5 KiB
Raw Permalink Blame History

Malware / planted IOC set — www.archline.hu

Authoritative source: the archline.hu incident analysis (operator-held), §7/13/14/16. These items are excluded from the baseline so the HIDS baseline-diff flags them on the live server. Machine-readable path list: malware-iocs.paths.

Trojanized core — restored to clean vanilla (NOT patched)

The 3 injected core files are provided clean by the official Joomla 3.8.11 package in core/; the live (malware) versions are simply not used:

File Injection
plugins/authentication/joomla/joomla.php credential-stealer, C2 leitungs-shop.de, exfil on every login (§16.3)
libraries/joomla/session/storage.php session-init loader for the dropped backdoor
libraries/joomla/event/event.php framework-level output injector

Dropped core backdoors — excluded (not in vanilla)

File Nature
libraries/joomla/session/cache.php obfuscated eVaL backdoor (dropped)
administrator/components/com_joomlaupdate/never.php cookie-gated RCE (2026-07-10)

Root webshells — excluded

  • wp-stomp.php — SEO-cloaking injector
  • hyjhxp.php — WSO webshell

Attacker modules (entire dir) — excluded

  • modules/mod_seolite — chain root (base64+LZW+eval)
  • modules/mod_articles_single — webshell (the monolith wrongly kept it; §14.2)

Dropped webshells inside legit dirs — only the dropped file excluded

  • modules/mod_al_upload/b8.php (legit module base kept)
  • modules/mod_course_list/a1.php (legit module base kept)
  • templates/trada/html/mod_articles_category/meant.php (legit 2015 template kept)
  • templates/category/tiny.php (Tiny File Manager backdoor)

Template infection / SEO spam

  • templates/shaper_helix3/index.php — fbwjedi cloaking block → the clean template index.php is used (the infected live one is excluded and replaced).
  • templates/system/links.db — Sape SEO link-spam (23KB serialized).

Planted components (entire dir) — excluded

  • com_extplorer (planted CVE-carrying file manager, 2024-07-15)
  • com_joml_incf, com_sys_rom (webshells)

Scan artifacts (not real files) — excluded

  • *.php.json, *.phtml.json, h3x_*, _h3x_* (web-hids inventory outputs)

Non-malware note (hygiene, not excluded)

  • components/com_users/controllers/registration.php carries a hardcoded reCAPTCHA secret (Cadline's own leaked secret) — the file stays (real source); the secret is to be rotated on cleanup. Not quoted here (redaction).