I had a user on our shared host who let their Wordpress install fall victim of an exploit that allowed for arbitrary file creation as the apache user. The files generated are obviously generated with a random generator, but fall under some sort of pattern. I was also thinking about just matching the group, but a find of that nature hits too many files that are legitimate. How can I match all of these example malicious files?
8twcoasx.php hjoeksdp.php nzpsmujc.php oiczdqkp.php wpebruwi.php wuclgsvz.php tie9txh5.php vza6pn12.php nwfthzli.php 1wovcnq6.php 1fwevaol.php zscy86d8.php ikz45skj.php n70x0aul.php nwk34bs0.php ugdnncmz.php wdcq2zzi.php 8f4w3dmt1z.php uqv4e2cm2a.php 55zf4u1dp7.php szfc8v129e.php oihfoe09fposf.php (occured more often) Jwlsjd_baaqifg.php (occured more often)
I'll obviously be working with the user to update their Wordpress install and plugins, but I would appreciate a regex I can toss into find and quickly verify whether the issue persists afterward, etc.
Patterns I can see:
- Always 8, 10, or 13 characters.
- Always *.php