PHP2Shell

Final Joe Reverser Analysis Report

Executive Summary

The confirmed PHP2Shell exploitation campaign delivers the supplied Mirai-like Linux payload, which supports distributed denial-of-service attacks, remote shell access, and replacement-payload downloads. Analysis recovered its exact configuration-encryption parameters and verified all 473 configuration entries against saved process memory. Existing execution evidence confirms C2 discovery and contact, system and process inspection, a local control listener, and successful process termination; it does not demonstrate an executed DDoS command, interactive shell session, or completed update.

“Mirai-like” describes the confirmed campaign context and the payload’s architecture and capabilities. A specific malware-family attribution was not independently established.

1. Confirmed Campaign Chain

PHP2Shell is the confirmed initial-access mechanism associated with this final-stage ELF.

PHP2Shell — CONFIRMED INITIAL ACCESS
  └─ Payload Delivery
      └─ Mirai-like Linux ELF
          └─ ChaCha20 Decryption
              └─ C2
                  ├─ notable sink: DDoS packet and request generation
                  ├─ notable sink: interactive shell execution
                  └─ notable sink: replacement-payload download and execution

2. Sample Identification

3. Evidence and Limitations

Evidence supporting the assessment

• Static disassembly and recovered decompilation expose command routing, attack dispatch, shell execution, update retrieval, process management, and cryptographic routines.
• Independent ChaCha20 decryption recovered 473 configuration entries and 11 auxiliary message registrations.
• All 473 configuration entries matched the corresponding tables in saved memory for PIDs 5267, 5270, and 5287.
• An existing exact-hash analysis recorded the DNS answer, the transformed connection destination, local listening activity, process enumeration, and successful SIGKILL operations.

Important limitations

• The PHP2Shell association is confirmed campaign context. The inspected artifacts do not provide the original exploit request or delivery script, so no CVE identifier, exploit syntax, or delivery command is assigned.
• The existing execution evidence does not establish successful encrypted session negotiation, received attack commands, an interactive shell session, or a completed replacement download.
• Tool call limits eventually constrained further decompilation and shell inspection. Substantial static analysis had already succeeded, but some attack vectors are classified by verified transport behavior rather than fully reconstructed application semantics.
• ENS identifiers and RPC-provider strings were decrypted, but their operational use was not demonstrated. The recorded execution used the primary DNS-discovery route.
• The identities and security roles of all terminated processes were not established.
• No additional executable stage was recovered for analysis. Configuration decryption is established; it is not presented as executable unpacking.

These limitations restrict claims about exercised capabilities and attribution, rather than materially weakening the malicious verdict.

4. Malware Behavior Summary

Observed behavior

Statically established capabilities

The payload can parse remote attack commands, fork timed workers, generate UDP/TCP/ICMP/raw-IP traffic, and construct application-layer requests. A separate framed channel opens an interactive shell using a PTY or socket-pair fallback. Its update path selects an architecture-specific payload, downloads it over HTTP, applies executable permissions, and invokes it.

5. ChaCha20 and Plaintext Configuration

Exact cryptographic parameters

The constant string is stored at 0x426F20, XOR-obfuscated with 0xA5:

Stored bytes:     c0ddd5c4cbc185969788c7dcd1c085ce
Decoded bytes:    657870616e642033322d62797465206b
Decoded ASCII:    expand 32-byte k
State constants:  61707865 3320646e 79622d32 6b206574

The implementation uses the characteristic 16-, 12-, 8-, and 7-bit rotations, ten double rounds, state addition, and little-endian keystream serialization.

Each configuration entry starts a fresh cipher using the same key, nonce, and counter. Independent recovery therefore decrypts each entry separately from stream offset 64.

Significant plaintext entries

The full plaintext table is preserved in the text configuration artifact and JSON configuration artifact.

6. C2 Infrastructure and Protocols

IPv4 permutation

Routine 0x413189 resolves the configured discovery names and maintains a deduplicated pool of up to 32 transformed IPv4 addresses.

Routine 0x4143AE changes the octet order:

Input:   A.B.C.D
Output:  A.D.B.C

Recorded DNS answer:  134.154.64.199
Transformed endpoint: 134.199.154.64
Recorded port:        50488/TCP

This transformation directly explains the difference between the recorded DNS answer and contacted IP.

The main loop tracks attempted addresses in a bitmap and supports reselection following connection failures.

Port selection

Routine 0x413AAA selects from the table at 0x4287E0:

50217 50341 50488 50613 50792 50904 51127
51289 51456 51603 51871 52134 52398 52645

Only port 50488 was established as contacted in the inspected run.

The separate port-1234 mechanism at 0x412D78 provides local instance control. It is distinct from the remote C2 destination.

Encryption paths

The alternate record format is:

type[1] | length_BE[2] | sequence_LE[2] |
ciphertext[length] | MAC[16]

Its nonce builder at 0x41266C produces four zero bytes followed by a 64-bit little-endian sequence value. Alternate derivation labels are wrx-2\x01, wtx-2\x01, and mac-2\x01.

Bootstrap secret and static identity

Routine 0x4122E0 reconstructs the bootstrap secret from obfuscated arrays at 0x4287B0 and 0x4287A0. The resulting secret equals the configuration key.

Routine 0x411361 hashes that secret and clamps the result for X25519:

Static scalar:
20f461ac9ef11d34d833643ef2bb437d4ad083584a01332def656e1250c72959

Static public key:
c21deecda716a64ce01f540bad72116bf488fc84150aef22fd6dff238b9f2166

These are reproducibly recovered static values, not live session keys. The normal handshake also generates ephemeral material.

7. DDoS Handlers and Dispatch

The command parser at 0x400F7D extracts a big-endian duration, vector identifier, target count, IPv4/prefix records, and optional typed values. Worker creation and handler selection occur at 0x400D2B.

The dispatch table starts at 0x62B000. Its count byte at 0x62B180 is 24.

The table therefore contains 24 slots, including one inert stub.

Static packet-generation features include raw sockets, IP_HDRINCL, checksums, randomized headers and payloads, configurable ports and TCP flags, prefix-based destination variation, repeated transmission, and timed worker termination. Application-related material includes GET/POST/HEAD templates, variable user agents, CitizenFX strings, /client, /info.json, and getinfo xxx.

Special zero-duration commands are:

• Vector 0xFF: stop tracked workers through 0x400CD7.
• Vector 0xFE: invoke the update path through 0x40C527.

8. Remote Shell and Updates

Interactive shell

Routine 0x40AA12 processes a separate shell protocol:

magic[4] | type[1] | payload_length_BE[2] | payload

The magic is c4 71 29 b8; parser 0x40B0FB limits payload length to 0x1000.

The implementation selects a shell, attempts PTY allocation through /dev/ptmx, forks, creates a session, redirects standard descriptors, sets terminal/environment values, and executes the shell. A socket-pair fallback supports execution without successful PTY setup.

Payload replacement

The update path uses server hackattackkaboom.botlesscucks.st. Routine 0x40B5D3 selects the architecture; this build selects x86_64, producing request path /x86_64.

The downloader at 0x40B89C connects over TCP port 80, constructs an HTTP GET request, selects a writable location, tests it using .upd_w, parses the response, and writes the body. The caller at 0x40C42A applies mode 0755 and invokes execve, preserving the bot identifier.

The observed mount inspection supports filesystem-selection activity, not a completed update.

9. Evasion and Process Termination

Masquerading: Routine 0x4139D0 overwrites argument storage and calls prctl(PR_SET_NAME, ...). It selects service-like names including telnetd, udhcpc, upnpd, watchdog, syslogd, klogd, uhttpd, and uchttpd.

Daemonization: The main routine forks, calls setsid, closes standard descriptors, and starts additional workers. The recorded sample process tree contains PIDs 5267, 5268, 5269, 5270, and 5287.

Anti-debugging: Routine 0x412511 examines a process-status file for TracerPid:. Handshake routine 0x4132D0 checks this result before proceeding and directs a detected-tracer condition toward connection-reset handling.

Selective termination: Process-management routines maintain internal PID exclusions and inspect process data and paths. The termination loop at 0x415FC6 reaches kill(pid, SIGKILL) at 0x416247. Successful process killing was observed, although the roles of all targets remain unresolved.

10. Verified Control-Flow Outlines

Initialization and configuration

Application initialization: 0x4001D0
  ├─ 0x40DBA0: register encrypted configuration
  │   └─ 0x40D8FA: allocate and decrypt each entry
  │       └─ notable sink: 0x40D6C6 ChaCha20 → plaintext configuration table
  ├─ 0x413189: resolve and populate C2 address pool
  │   └─ notable sink: 0x4143AE IPv4 permutation A.B.C.D → A.D.B.C
  └─ 0x4132D0: prepare C2 handshake
      └─ 0x412511: TracerPid check before handshake progression

Remote command handling

Received-command router: 0x4138F6
  ├─ 0x40AA12: recognize shell-channel frames
  │   └─ notable sink: shell execution with PTY or socket-pair redirection
  └─ 0x400F7D: parse attack/control command
      ├─ 0x400D2B: fork and dispatch selected vector
      │   └─ notable sink: network transmission through handler table 0x62B000
      ├─ duration 0, vector 0xFF → 0x400CD7
      │   └─ notable sink: SIGKILL tracked workers
      └─ duration 0, vector 0xFE → 0x40C527
          └─ 0x40C42A → 0x40B89C
              └─ notable sink: HTTP retrieval → chmod 0755 → execve

No separate executable-unpacking outline is warranted by the recovered evidence.

11. Indicators of Compromise

The decrypted table also contains ethereum.publicnode.com, ethereum-rpc.publicnode.com, eth.drpc.org, 1rpc.io, eth-mainnet.blockreq.com, ethereum-public.nodies.app, and rpc.mevblocker.io. These are embedded provider references, not established attacker-owned infrastructure or observed destinations.

12. False Positive Analysis

Individual features such as static linking, encryption, process enumeration, PTYs, and HTTP downloads can occur in legitimate software. Here, their combination is materially different: remote attack dispatch, raw-packet flooding loops, interactive shell control, executable replacement, concealed configuration, process-name camouflage, and selective termination form a coherent malicious bot implementation.

The verdict does not depend on the reputation of public RPC providers, a family label, or the presence of a single suspicious string. It is supported by verified code behavior and independent runtime corroboration.

13. Existing Joe Sandbox Analysis

The Joe Reverser assessment is Malicious, 98/100, based on the combined reverse-engineering and execution evidence. The sandbox’s 24/100 result reflects its recorded run and is retained separately.

14. Analysis Workflow

Submitted ELF investigation
  ├─ Identify architecture, entry point, sections, and hashes
  ├─ Inspect application routines with disassembly and decompilation
  ├─ Locate existing exact-hash analysis 1990431, run 0
  │   └─ Retrieve 22 saved memory-region dumps
  ├─ Recover ChaCha20 parameters and decrypt configuration
  │   └─ Verify all 473 entries against three process-memory tables
  ├─ Trace C2, attack dispatch, shell, update, and process-control paths
  └─ Correlate static findings with recorded execution
      └─ Separate demonstrated behavior from unexercised capabilities

Conclusion

The confirmed PHP2Shell exploitation chain culminates in a malicious Linux bot with encrypted configuration, transformed C2 addressing, multiple flooding implementations, remote shell execution, and payload replacement. The exact key and nonce, matching memory-resident plaintext, and observed destination permutation provide particularly strong technical anchors. Operational evidence confirms host inspection, C2 contact, local control activity, and process killing; the broader attack and remote-control features remain verified code capabilities rather than demonstrated outcomes of the inspected run.