🔴 R4gn4r0 Mailer 1.0

A straightforward PHP script called R4gn4r0 Mailer is used to send bulk emails from WordPress websites that have been hacked. It offers capabilities like email address filtering, mass emailing, and blacklist checking and is essentially a clone of the LeafMailer.

The malware is often discussed as a wp-active2.php file.

Simple login form, the password is stored inside the code:

image 13 - 🔴 R4gn4r0 Mailer 1.0 — R4gn4r0 Mailer login form

image 14 - 🔴 R4gn4r0 Mailer 1.0 — R4gn4r0 Mailer password

Email filter:

image 16 1024x547 - 🔴 R4gn4r0 Mailer 1.0

Mass mailer:

It appears as though someone simply added colors and changed the language to Spanish because the source code is nearly identical to LeafMailer.

Emails mentioned inside the source code: [email protected] [email protected] [email protected]

IP addresses that have known to exploit this script: 45.91.20.96

45.91.20.96 - - [27/Sep/2022:23:14:58 +0200] "POST /wp-active2.php HTTP/2.0" 200 10884 "https://somedomain.rs/wp-active2.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36"
45.91.20.96 - - [27/Sep/2022:23:15:01 +0200] "POST /wp-active2.php HTTP/2.0" 200 131315 "https://somedomain.rs/wp-active2.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36"
45.91.20.96 - - [27/Sep/2022:23:16:08 +0200] "POST /wp-active2.php HTTP/2.0" 200 22514 "https://somedomain.rs/wp-active2.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36"
45.91.20.96 - - [27/Sep/2022:23:17:05 +0200] "POST /wp-active2.php HTTP/2.0" 200 32377 "https://somedomain.rs/wp-active2.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36"
45.91.20.96 - - [27/Sep/2022:23:17:21 +0200] "POST /wp-active2.php HTTP/2.0" 200 32377 "https://somedomain.rs/wp-active2.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36"
45.91.20.96 - - [27/Sep/2022:23:17:28 +0200] "POST /wp-active2.php HTTP/2.0" 200 15952627 "https://somedomain.rs/wp-active2.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36"
45.91.20.96 - - [27/Sep/2022:23:23:41 +0200] "POST /wp-active2.php HTTP/2.0" 200 45077 "https://somedomain.rs/wp-active2.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36"
45.91.20.96 - - [27/Sep/2022:23:23:47 +0200] "POST /wp-active2.php HTTP/2.0" 200 36430158 "https://somedomain.rs/wp-active2.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36"
45.91.20.96 - - [27/Sep/2022:23:30:53 +0200] "POST /wp-active2.php HTTP/2.0" 200 45077 "https://somedomain.rs/wp-active2.php" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36"

Was this post helpful?

Let me know if you liked the post. That’s the only way I can improve. 🙂

Cookie	Duration	Description
cookielawinfo-checkbox-analytics	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Analytics".
cookielawinfo-checkbox-functional	11 months	The cookie is set by GDPR cookie consent to record the user consent for the cookies in the category "Functional".
cookielawinfo-checkbox-necessary	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookies is used to store the user consent for the cookies in the category "Necessary".
cookielawinfo-checkbox-others	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Other.
cookielawinfo-checkbox-performance	11 months	This cookie is set by GDPR Cookie Consent plugin. The cookie is used to store the user consent for the cookies in the category "Performance".
viewed_cookie_policy	11 months	The cookie is set by the GDPR Cookie Consent plugin and is used to store whether or not user has consented to the use of cookies. It does not store any personal data.

Cookie	Duration	Description
_ga	2 years	The _ga cookie, installed by Google Analytics, calculates visitor, session and campaign data and also keeps track of site usage for the site's analytics report. The cookie stores information anonymously and assigns a randomly generated number to recognize unique visitors.
_gid	1 day	Installed by Google Analytics, _gid cookie stores information on how visitors use a website, while also creating an analytics report of the website's performance. Some of the data that are collected include the number of visitors, their source, and the pages they visit anonymously.

Cookie	Duration	Description
__gads	1 year 24 days	The __gads cookie, set by Google, is stored under DoubleClick domain and tracks the number of times users see an advert, measures the success of the campaign and calculates its revenue. This cookie can only be read from the domain they are set on and will not track any data while browsing through other sites.
test_cookie	15 minutes	The test_cookie is set by doubleclick.net and is used to determine if the user's browser supports cookies.

Was this post helpful?

Leave a Comment Cancel reply