Why is apache downloading some files from a remote server?

Question

Apache HTTP Server

Guys, the trouble is that apache is downloading some obscure files. Here is an excerpt from the error-log

--2014-03-23 06:31:41--  http://78.70.29.192:58455/armeabi
Connecting to 78.70.29.192:58455...
connected.
HTTP request sent, awaiting response...
200 OK
Length: 131812 (129K)
Saving to: `/tmp/armeabi'

      0K .

This is not the first time. When I first encountered this, I forbade php to call the functions: exec, passthru, shell_exec, system, proc_open, popen, curl_exec, curl_multi_exec, show_source
But after that, such entries still appear. And in / tmp there is nothing of the kind. The file itself is a binary. Moreover, the process of downloading files begins immediately after starting apache.
Who knows where to dig? Maybe someone came across?

Answer 1

Guys, I got advice from a specialist who suggested that I need to dig towards CGI scripts. In the virtual domain settings, the launch of CGI scripts was allowed. The POST request passed such data that forced apache to process this request and execute it as a cgi script. It is enough to disable cgi execution and the problem is solved.

Answer 2

It is not Apache that downloads, but a php script .. The
log seems to be from wget. So apparently not all exec in php you banned.

Answer 3

the backdoor can be updated, maybe he wanted)))
armeabi.so he might want to.
some isp manager updates, or someone else.
There you can see from the link what exactly he is downloading.
xs what it does, and at the end
information'№u'ЖРЖШД(=A'aeabi4T .shstrtab.init.text.fini.rodata.ARM.exidx.eh_frame.init_array.fini_array.jcr.data.bss.ARM.attributesіАі»A »ћЎФYФў®Y®ўl#%pВ}e0}e:AFARAW

Answer 4

I tried to download this file - the antivirus started swearing that it was a Linux/Darlloz.B worm Linux.Darlloz
- a network worm for Linux devices
Apache.
I also read here that he uses the Parallels Plesk Panel vulnerability and the PHP vulnerability, then rebuild / reinstall PHP as well.
PS also found information that this worm is used to mine *coin on the affected machine