SC Backdoor PHP backdoor
SC Backdoor is a WordPress implant that reads its controller from an Ethereum contract, generates administrator cookies and repairs deleted copies of itself.
An encoded plugin reads its controller from Ethereum
SC Backdoor runs as a WordPress plugin with substitution-encoded strings and random-looking function names. MD Pabel's SC WordPress malware research describes its Ethereum controller lookup, administrator-cookie forgery and self-repairing persistence.
The PHP contains an eth_call request with selector 0x3bc5de30. It tries public Ethereum RPC providers, decodes the contract's response and uses the returned controller addresses for its requests. The plugin keeps the last working RPC provider in sc_last_rpc.
Administrator cookies preserve access
The backdoor calls wp_generate_auth_cookie and uses WP_Session_Tokens to create authentication and logged-in cookies for existing administrators. It sends the generated cookies to its controller. It also hooks successful administrator logins to collect passwords and hides an administrator account from WordPress user views.
Files and database state rebuild the plugin
The repair code uses must-use plugins, WordPress drop-ins and theme hooks to restore the implant. SC_ADV, SC_DB and SC_TH markers identify blocks in advanced-cache.php, db.php and theme code. Compressed backup copies and database state give those hooks material to write back to disk.
sc_payload_persistent retains controller-supplied data, while sc_persist_manifest records the persistence files. The sc_cron_fetch event schedules controller polling, and recovery routines check and restore the planted code. Removing the visible plugin leaves these repair paths running.
Removing the repair paths together
Take the site offline and preserve the files and database before cleanup. Inspect:
- ordinary plugins and
wp-content/mu-pluginsfor substitution-encoded PHP advanced-cache.php,db.phpand themefunctions.phpfor SC marker blocks.user.ini,.htaccessand PHP configuration for added startup hooks- backup archives and loaders under
wp-content, uploads, themes and cache directories sc_payload_persistent,sc_persist_manifest, SC transients and scheduled events- administrator accounts and session data directly in the database
Remove the implant, its restore hooks and stored backups in the same maintenance window, then rebuild changed files from trusted releases. Rotate WordPress and hosting credentials and WordPress salts, invalidate sessions, clear caches and restart clean PHP workers. Inspect other sites under the same hosting account for the same repair code.