helper.php
helper.php is a PHP backdoor linked in the reporting to the threat cluster tracked as Mr_Rot13. Researchers identified it as a PHP file uploaded to VirusTotal in 2022 that at the time reportedly had zero antivirus detections. The sample communicated with the domain wrned.com, specifically reporting request metadata to https://wrned.com/api.php?t=3&c=1, and used XOR-based string obfuscation. The reporting states that the malicious code was hidden inside a legitimate WordPress file, indicating WordPress was also targeted by the same actor. Attribution to Mr_Rot13 is based on infrastructure overlap with later activity using wrned.com and related infrastructure. A reported sample hash for helper.php is MD5 2286f126ab4740ccf2595ad1fa0c615c.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Researchers discovered a PHP backdoor named helper.php linked to the Mr_Rot13 threat group and uploaded to VirusTotal in 2022 with no antivirus detections.
Techniques & procedures
7 distinct techniques documented for this family, organized by ATT&CK tactic.
Persistence
2 techniques
Persistence
Stealth
2 techniques
Stealth
Collection
1 technique
Collection
Command and Control
1 technique
Command and Control
IOCs tracked for this family
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A PHP backdoor linked to Mr_Rot13 that hides malicious code inside a legitimate WordPress file using XOR string obfuscation, collects victim and request metadata, and communicates with a remote command-and-control server.
A PHP backdoor uploaded to VirusTotal in 2022 that communicates with wrned.com, reports request/environment details to C2, and contains an RC4-encrypted payload whose final functionality could not be fully recovered due lack of valid C2 responses.
A PHP backdoor linked to wrned.com that reports request metadata to C2 and receives JSON containing values used to validate requests and decrypt a hardcoded RC4-encrypted payload.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.