b374k.php is a widely known, open-source web shell. It is a malicious script that, once uploaded to a web server, allows an attacker to execute system commands, manage files, browse databases, and bypass security controls. Its presence on a server is a definitive indicator of compromise (IoC).
Check your web server access logs (/var/log/apache2/access.log or /var/log/nginx/access.log). Search for the filename:
grep "b374k.php" access.log
grep "wp-verify.php" access.log
Look for the first GET request to that file. The source IP address is the attacker’s (though likely a VPN/proxy). Also look for POST requests after the GET – that shows what commands they ran.
If you're trying to detect or remove a b374k.php shell from a server: b374k.php
Unless you are 100% certain of the attacker’s methods, you cannot trust the server again. Web shells are often used to install rootkits. The safest response:
The file’s name is a clue to its nature. While often saved as b374k.php, attackers almost never leave it with that default name. Upon successful installation, they will rename it to something inconspicuous, such as:
The goal is simple: to blend in with thousands of legitimate PHP files running on a busy web server. Look for the first GET request to that file
To be intellectually honest, there is one scenario where b374k.php is used legitimately: by hosting providers locked out of their own server.
Imagine a scenario: A system administrator for a shared hosting provider accidentally locks themselves out of ssh, and the control panel (cPanel/Plesk) is corrupted. The only access remaining is FTP. In this desperate situation, an admin might upload b374k.php to gain file management and command execution via the web browser to fix the broken SSH configuration.
However, best practices vehemently forbid this. Why? The file’s name is a clue to its nature
Verdict: Legitimate use is possible but reckless. A VPN + sshd is always superior.
| Attribute | Details |
| :--- | :--- |
| Filename | b374k.php (can be renamed to any .php, .php5, .phtml, etc.) |
| Typical Size | 10KB – 200KB (depending on version and obfuscation) |
| File Hash (Example) | 7a3e7f9b8c2d1a5e6f4g8h2i3j4k5l6m (varies by version) |
| First Seen | ~2012 (still actively used in 2025) |
The presence of a b374k.php backdoor on a server has severe implications: