{ "ml": { "v": "4", "fs": [ { "id": 0, "prob": 0.9995731711387634, "class": 2 } ], "prob": 0.9995732, "class": 2, "models": [ { "m": "az", "prob": 0.9772996, "class": 0 }, { "m": "az/scripts", "prob": 0.9994809, "class": 1 }, { "m": "az/php", "prob": 0.9995732, "class": 2 } ], "version": "v16.16", "thresholds": [ 0.9961138, 0.99909174 ], "analyzed_at": "2026-05-10T03:09:47Z" }, "path": "redirecturl.php", "raw": { "v": "4", "fs": [ { "f": "O₃(C₄XeAl)H₅(PoCmCrF₃Os)", "k": { "source.imports[0]": "abs", "source.imports[1]": "base64_decode", "source.imports[2]": "basename", "source.imports[3]": "bcmul", "source.imports[4]": "count", "source.imports[5]": "crc32", "source.imports[6]": "curl_close", "source.imports[7]": "curl_exec", "source.imports[8]": "curl_init", "source.imports[9]": "curl_setopt", "source.strings[0]": "/bot|crawl|spider|mediapartners|slurp|patrol/i", "source.strings[1]": "/sess_", "source.strings[2]": "19131421", "source.strings[3]": "\u003ca href=", "source.strings[4]": "\u003ca href=\\", "source.strings[5]": "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdefghijklmnopqrstuvwxyz-_-_/", "source.strings[6]": "Data_arr", "source.strings[7]": "HTTP_USER_AGENT", "source.strings[8]": "HTTP_X_FORWARDED_PROTO", "source.strings[9]": "HTTP_X_FORWARDED_SSL", "source.has_imports": true, "source.imports[10]": "date", "source.imports[11]": "dirname", "source.imports[12]": "empty", "source.imports[13]": "eval", "source.imports[14]": "explode", "source.imports[15]": "fclose", "source.imports[16]": "file_exists", "source.imports[17]": "file_get_contents", "source.imports[18]": "filemtime", "source.imports[19]": "fopen", "source.imports[20]": "fread", "source.imports[21]": "function_exists", "source.imports[22]": "fwrite", "source.imports[23]": "get_between", "source.imports[24]": "get_cache", "source.imports[25]": "get_static_arr", "source.imports[26]": "get_temp_dir_mass", "source.imports[27]": "hashCode", "source.imports[28]": "http_get", "source.imports[29]": "ini_get", "source.imports[30]": "is_readable", "source.imports[31]": "is_writeable", "source.imports[32]": "isset", "source.imports[33]": "local_host", "source.imports[34]": "local_url", "source.imports[35]": "md5", "source.imports[36]": "mt_rand", "source.imports[37]": "preg_match", "source.imports[38]": "rand_str", "source.imports[39]": "realpath", "source.imports[40]": "session_save_path", "source.imports[41]": "str_ireplace", "source.imports[42]": "stristr", "source.imports[43]": "strlen", "source.imports[44]": "strpos", "source.imports[45]": "strtolower", "source.imports[46]": "substr", "source.imports[47]": "substr_replace", "source.imports[48]": "sys_get_temp_dir", "source.imports[49]": "tempnam", "source.imports[50]": "time", "source.imports[51]": "trim", "source.imports[52]": "unlink", "source.strings[10]": "REQUEST_URI", "source.strings[11]": "SCRIPT_NAME", "source.strings[12]": "SERVER_NAME", "source.strings[13]": "SERVER_PORT", "source.strings[14]": "TMPDIR", "source.strings[15]": "Y-m-d-H-i", "source.strings[16]": "[ahref]", "source.strings[17]": "[time]", "source.strings[18]": "abcdefghijklmnopqrstuvwxyz", "source.strings[19]": "curl_init", "source.strings[20]": "file_get_contents", "source.strings[21]": "http://", "source.strings[22]": "http://god.sm79.xyz/api.php?g=gitt", "source.strings[23]": "https://", "source.strings[24]": "index.php", "source.strings[25]": "keyword", "source.strings[26]": "sitel1", "source.strings[27]": "sys_get_temp_dir", "source.strings[28]": "update", "source.strings[29]": "upload_tmp_dir", "source.functions[0]": "_base_url", "source.functions[1]": "_get_between", "source.functions[2]": "_get_cache", "source.functions[3]": "_get_static_arr", "source.functions[4]": "_get_temp_dir_mass", "source.functions[5]": "_http_get", "source.functions[6]": "_local_host", "source.functions[7]": "_local_url", "source.functions[8]": "content_process", "source.functions[9]": "hashCode", "source.functions[10]": "isBot", "source.functions[11]": "rand_str" }, "x": 307, "id": 0, "is": [ "function_exists", "is_writeable", "sys_get_temp_dir", "is_readable", "sys_get_temp_dir", "realpath", "sys_get_temp_dir", "empty", "is_writeable", "realpath", "is_readable", "realpath", "empty", "is_writeable", "realpath", "is_readable", "realpath", "empty", "is_writeable", "realpath", "is_readable", "realpath", "tempnam", "file_exists", "unlink", "is_writeable", "realpath", "dirname", "is_readable", "realpath", "dirname", "realpath", "dirname", "is_writeable", "realpath", "ini_get", "is_readable", "realpath", "ini_get", "realpath", "ini_get", "is_writeable", "realpath", "session_save_path", "is_readable", "realpath", "session_save_path", "realpath", "session_save_path", "is_writeable", "realpath", "dirname", "is_readable", "realpath", "dirname", "realpath", "dirname", "isset", "preg_match", "empty", "md5", "substr", "substr", "abs", "crc32", "abs", "crc32", "substr", "bcmul", "mt_rand", "strlen", "mt_rand", "mt_rand", "strlen", "mt_rand", "function_exists", "file_get_contents", "function_exists", "curl_init", "curl_setopt", "curl_setopt", "curl_setopt", "curl_exec", "curl_close", "function_exists", "fopen", "fread", "strlen", "fclose", "isset", "empty", "empty", "get_temp_dir_mass", "md5", "file_get_contents", "file_exists", "isset", "stristr", "stristr", "time", "filemtime", "http_get", "fopen", "fwrite", "fclose", "local_host", "local_host", "str_ireplace", "str_ireplace", "basename", "str_ireplace", "dirname", "stristr", "strtolower", "substr", "strlen", "strpos", "strlen", "strpos", "str_ireplace", "date", "time", "strpos", "substr_replace", "mt_rand", "count", "strlen", "strpos", "strpos", "str_ireplace", "mt_rand", "count", "str_ireplace", "get_static_arr", "strpos", "strpos", "explode", "mt_rand", "count", "explode", "get_static_arr", "count", "str_ireplace", "str_ireplace", "strpos", "mt_rand", "rand_str", "rand_str", "mt_rand", "date", "time", "rand_str", "rand_str", "mt_rand", "isset", "mt_rand", "count", "isset", "mt_rand", "count", "substr_replace", "strlen", "strpos", "hashCode", "count", "local_url", "base64_decode", "get_between", "get_cache", "eval", "get_static_arr", "explode", "get_static_arr", "trim" ], "ms": { "file": { "size": 8228.0 }, "text": { "digit_ratio": 0.03, "space_count": 1956.0, "total_lines": 228.0, "char_entropy": 4.96, "unique_chars": 92.0, "import_density": 76.32, "string_density": 0.99, "avg_line_length": 35.09, "max_line_length": 196.0, "empty_line_ratio": 0.0, "last_line_length": 7.0, "most_common_char": "t", "whitespace_ratio": 0.27, "most_common_ratio": 0.05, "identifier_density": 2.06, "line_length_stddev": 34.27, "encoded_string_ratio": 0.01, "normalized_import_count": 11.52, "normalized_string_count": 14.97, "repeated_char_sequences": 38.0, "max_inline_whitespace_run": 1.0, "normalized_function_count": 0.79, "imports_to_functions_ratio": 14.5, "strings_to_functions_ratio": 18.83, "suspicious_identifier_ratio": 0.04, "normalized_unique_identifiers": 14.04, "identifiers_to_functions_ratio": 9.17 }, "imports": { "total": 174.0, "unique_modules": 53.0, "third_party_count": 174.0, "third_party_ratio": 1.0 }, "strings": { "total": 226.0, "url_count": 6.0, "avg_length": 6.59, "max_length": 67.0, "path_count": 4.0, "avg_entropy": 1.63, "hex_strings": 2.0, "total_bytes": 1489.0, "entropy_stddev": 1.39, "high_entropy_count": 2.0 }, "comments": {}, "functions": { "total": 12.0, "length_stddev": 14.55, "avg_name_length": 10.83, "no_params_count": 12.0, "avg_length_lines": 17.67, "max_length_lines": 56.0, "min_length_lines": 4.0, "density_per_100_lines": 5.26, "code_in_functions_ratio": 0.93 }, "identifiers": { "total": 470.0, "avg_length": 7.35, "max_length": 22.0, "min_length": 1.0, "avg_entropy": 2.33, "reuse_ratio": 0.23, "unique_count": 110.0, "length_stddev": 4.26, "has_digit_ratio": 0.06, "sequential_names": 4.0, "single_char_count": 4.0, "single_char_ratio": 0.04, "all_lowercase_ratio": 0.83, "all_uppercase_ratio": 0.06, "numeric_suffix_count": 6.0, "double_underscore_count": 1.0, "underscore_prefix_count": 13.0 } }, "ss": [ [ 62, "sys_get_temp_dir" ], [ 63, "sys_get_temp_dir" ], [ 256, "TMP" ], [ 257, "TMP" ], [ 296, "TMP" ], [ 297, "TMP" ], [ 327, "TMP" ], [ 328, "TMP" ], [ 368, "TMP" ], [ 369, "TMP" ], [ 404, "TMPDIR" ], [ 405, "TMPDIR" ], [ 447, "TMPDIR" ], [ 448, "TMPDIR" ], [ 481, "TMPDIR" ], [ 482, "TMPDIR" ], [ 525, "TMPDIR" ], [ 526, "TMPDIR" ], [ 564, "TEMP" ], [ 565, "TEMP" ], [ 605, "TEMP" ], [ 606, "TEMP" ], [ 637, "TEMP" ], [ 638, "TEMP" ], [ 679, "TEMP" ], [ 680, "TEMP" ], [ 1008, "upload_tmp_dir" ], [ 1009, "upload_tmp_dir" ], [ 1062, "upload_tmp_dir" ], [ 1063, "upload_tmp_dir" ], [ 1118, "upload_tmp_dir" ], [ 1119, "upload_tmp_dir" ], [ 1495, "HTTP_USER_AGENT" ], [ 1496, "HTTP_USER_AGENT" ], [ 1529, "/bot|crawl|spider|mediapartners|slurp|patrol/i" ], [ 1530, "/bot|crawl|spider|mediapartners|slurp|patrol/i" ], [ 1588, "HTTP_USER_AGENT" ], [ 1589, "HTTP_USER_AGENT" ], [ 2005, "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdefghijklmnopqrstuvwxyz-_-_/" ], [ 2006, "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789abcdefghijklmnopqrstuvwxyz-_-_/" ], [ 2205, "." ], [ 2206, "." ], [ 2250, "abcdefghijklmnopqrstuvwxyz" ], [ 2251, "abcdefghijklmnopqrstuvwxyz" ], [ 2484, "file_get_contents" ], [ 2485, "file_get_contents" ], [ 2597, "curl_init" ], [ 2598, "curl_init" ], [ 2896, "fopen" ], [ 2897, "fopen" ], [ 2938, "rb" ], [ 2939, "rb" ], [ 3249, "HTTPS" ], [ 3250, "HTTPS" ], [ 3271, "HTTPS" ], [ 3272, "HTTPS" ], [ 3283, "on" ], [ 3284, "on" ], [ 3345, "HTTP_X_FORWARDED_PROTO" ], [ 3346, "HTTP_X_FORWARDED_PROTO" ], [ 3384, "HTTP_X_FORWARDED_PROTO" ], [ 3385, "HTTP_X_FORWARDED_PROTO" ], [ 3413, "https" ], [ 3414, "https" ], [ 3440, "HTTP_X_FORWARDED_SSL" ], [ 3441, "HTTP_X_FORWARDED_SSL" ], [ 3477, "HTTP_X_FORWARDED_SSL" ], [ 3478, "HTTP_X_FORWARDED_SSL" ], [ 3504, "on" ], [ 3505, "on" ], [ 3564, "https://" ], [ 3565, "https://" ], [ 3577, "http://" ], [ 3578, "http://" ], [ 3617, "SERVER_NAME" ], [ 3618, "SERVER_NAME" ], [ 3650, "SERVER_PORT" ], [ 3651, "SERVER_PORT" ], [ 3683, "SERVER_PORT" ], [ 3684, "SERVER_PORT" ], [ 3740, "SERVER_PORT" ], [ 3741, "SERVER_PORT" ], [ 3869, "/sess_" ], [ 3870, "/sess_" ], [ 3974, "update" ], [ 3975, "update" ], [ 3994, "update" ], [ 3995, "update" ], [ 4007, "19131421" ], [ 4008, "19131421" ], [ 4037, "-\u003e|" ], [ 4038, "-\u003e|" ], [ 4063, "|\u003c-" ], [ 4064, "|\u003c-" ], [ 4183, "w" ], [ 4184, "w" ], [ 4387, "REQUEST_URI" ], [ 4388, "REQUEST_URI" ], [ 4510, "//" ], [ 4511, "//" ], [ 4516, "/" ], [ 4517, "/" ], [ 4534, "\\\\" ], [ 4540, "/" ], [ 4541, "/" ], [ 4554, "REQUEST_URI" ], [ 4555, "REQUEST_URI" ], [ 4600, "SCRIPT_NAME" ], [ 4601, "SCRIPT_NAME" ], [ 4691, "\\\\" ], [ 4697, "/" ], [ 4698, "/" ], [ 4817, "/" ], [ 4818, "/" ], [ 4864, "index.php" ], [ 4865, "index.php" ], [ 4943, "/" ], [ 4944, "/" ], [ 4995, "/" ], [ 4996, "/" ], [ 5366, "[time]" ], [ 5367, "[time]" ], [ 5381, "Y-m-d-H-i" ], [ 5382, "Y-m-d-H-i" ], [ 5482, "[" ], [ 5483, "[" ], [ 5493, "x]" ], [ 5494, "x]" ], [ 5621, "[" ], [ 5622, "[" ], [ 5632, "x]" ], [ 5633, "x]" ], [ 5674, "[" ], [ 5675, "[" ], [ 5685, "x]" ], [ 5686, "x]" ], [ 5774, "[" ], [ 5775, "[" ], [ 5790, "]" ], [ 5791, "]" ], [ 5883, "[" ], [ 5884, "[" ], [ 5899, "]" ], [ 5900, "]" ], [ 6015, "[" ], [ 6016, "[" ], [ 6031, "]" ], [ 6032, "]" ], [ 6253, "[" ], [ 6254, "[" ], [ 6264, "l" ], [ 6265, "l" ], [ 6275, "]" ], [ 6276, "]" ], [ 6310, "[" ], [ 6311, "[" ], [ 6321, "r" ], [ 6322, "r" ], [ 6332, "]" ], [ 6333, "]" ], [ 6418, "|" ], [ 6419, "|" ], [ 6517, "|" ], [ 6518, "|" ], [ 6674, "[" ], [ 6675, "[" ], [ 6685, "l" ], [ 6686, "l" ], [ 6696, "]" ], [ 6697, "]" ], [ 6767, "[" ], [ 6768, "[" ], [ 6778, "r" ], [ 6779, "r" ], [ 6789, "]" ], [ 6790, "]" ], [ 6934, "[ahref]" ], [ 6935, "[ahref]" ], [ 7048, "." ], [ 7049, "." ], [ 7129, "Y-m-d" ], [ 7130, "Y-m-d" ], [ 7148, "_" ], [ 7149, "_" ], [ 7167, "." ], [ 7168, "." ], [ 7236, "area" ], [ 7237, "area" ], [ 7280, "area" ], [ 7281, "area" ], [ 7315, "area" ], [ 7316, "area" ], [ 7369, "keyword" ], [ 7370, "keyword" ], [ 7417, "keyword" ], [ 7418, "keyword" ], [ 7455, "keyword" ], [ 7456, "keyword" ], [ 7528, "\u003ca href=\\" ], [ 7529, "\u003ca href=" ], [ 7551, "\\\"\u003e" ], [ 7554, "\u003e" ], [ 7569, "\u003c/a\u003e" ], [ 7570, "\u003c/a\u003e" ], [ 7588, "[ahref]" ], [ 7589, "[ahref]" ], [ 7631, "[ahref]" ], [ 7632, "[ahref]" ], [ 7842, "http://god.sm79.xyz/api.php?g=gitt" ], [ 7843, "http://god.sm79.xyz/api.php?g=gitt" ], [ 7881, "-\u003e|" ], [ 7882, "-\u003e|" ], [ 7888, "|\u003c-" ], [ 7889, "|\u003c-" ], [ 7959, "Data_arr" ], [ 7960, "Data_arr" ], [ 7981, "data" ], [ 7982, "data" ], [ 8013, "|" ], [ 8014, "|" ], [ 8047, "sitel1" ], [ 8048, "sitel1" ], [ 8067, "site" ], [ 8068, "site" ] ], "sz": 8228, "ts": [ { "c": 0.699999988079071, "d": "Reference to tempfile module", "e": [ "tempfile" ], "i": "micro-behaviors/fs/temp/reference::tempfile-ref", "l": 2 }, { "c": 0.6000000238418579, "d": "Generates HTML tags", "e": [ "\u003chtml" ], "i": "micro-behaviors/data/format/html::html-generator-tags", "l": 3 }, { "c": 0.949999988079071, "d": "PHP opening tag present", "e": [ "\u003c?php" ], "i": "metadata/lang/scripted::php-open-tag", "l": 1 }, { "c": 0.8999999761581421, "d": "HTTP protocol prefix", "e": [ "http://" ], "i": "micro-behaviors/communications/http/protocol::http-prefix", "l": 2 }, { "a": "T1071", "c": 0.6000000238418579, "d": "URL with .php endpoint", "e": [ "http://god.sm79.xyz/api.php" ], "i": "objectives/command-and-control/infrastructure/domain/tld::php-endpoint-url", "l": 1 }, { "c": 0.75, "d": "File read via file_get_contents", "e": [ "file_get_contents" ], "i": "micro-behaviors/fs/read/file::file-get-contents", "l": 2, "m": "C0051" }, { "a": "T1059.006", "c": 0.75, "d": "PHP eval() token present", "e": [ "eval" ], "i": "micro-behaviors/process/interpreter/eval::eval-symbol", "l": 4, "m": "E1059" }, { "c": 0.8600000143051147, "d": "Regex component marker", "e": [ "$_SERVER[" ], "i": "objectives/command-and-control/backdoor/webshell/ui::self-named-get-form--rx-4", "l": 1, "m": "B0030" }, { "c": 0.8999999761581421, "d": "HTTPS protocol prefix", "e": [ "https://" ], "i": "micro-behaviors/communications/http/protocol::https-prefix", "l": 2 }, { "c": 0.8999999761581421, "d": "File has 30 or more lines", "e": [ "text.total_lines = 228.00" ], "i": "metadata/file/text/metrics::file-has-30-plus-lines", "l": 1 }, { "a": "T1505.003", "c": 0.9399999976158142, "d": "file_get_contents (raw POST body reader)", "e": [ "file_get_contents" ], "i": "objectives/command-and-control/backdoor/webshell/request::raw-json-post-cmd-field--rx-7", "l": 1, "m": "B0030" }, { "c": 0.8399999737739563, "d": "\"upload\" string-literal token", "e": [ "upload_tmp_dir" ], "i": "micro-behaviors/data/text/llm/action::llm-send-action--rx-11", "l": 1 }, { "c": 0.699999988079071, "d": "MD5 hash computation", "e": [ "md5" ], "i": "micro-behaviors/crypto/hash/digest::md5-php", "l": 3, "m": "C0029" }, { "a": "T1505.003", "c": 0.8999999761581421, "d": "PHP source imports base64_decode", "e": [ "[abs, base64_decode, basename, bcmul, count, crc32, curl_close, curl_exec, curl_init, curl_setopt, date, dirname, empty, eval, e" ], "i": "objectives/command-and-control/backdoor/webshell/stager::source-import-base64-decode", "l": 1 }, { "c": 0.8399999737739563, "d": "\"forward\" string-literal token", "e": [ "HTTP_X_FORWARDED_SSL", "HTTP_X_FORWARDED_PROTO" ], "i": "micro-behaviors/data/text/llm/action::llm-send-action--rx-7", "l": 1 }, { "c": 0.800000011920929, "d": "Writes data to an open file", "e": [ "fwrite" ], "i": "micro-behaviors/fs/write/file/direct::fwrite", "l": 3, "m": "C0052" }, { "a": "T1071", "c": 0.75, "d": "URL with .xyz TLD", "e": [ "http://god.sm79.xyz/" ], "i": "objectives/command-and-control/infrastructure/domain/tld::tld-xyz", "l": 3 }, { "a": "T1546", "c": 1.0, "d": "Writes data to a file via functions", "e": [ "fopen(" ], "i": "micro-behaviors/fs/file/write/direct::php-file-write-func", "l": 2 }, { "c": 0.800000011920929, "d": "Custom HTTP header input access (HTTP_X_*)", "e": [ "$_SERVER['HTTP_X_FORWARDED_PROTO']" ], "i": "objectives/command-and-control/backdoor/webshell/exec::custom-header-input", "l": 4, "m": "B0030" }, { "c": 0.699999988079071, "d": "PHP error suppression operator usage", "e": [ "@is_readable($_ENV[\"TEMP\"])", "@file_exists($tempfile)", "@is_readable(sys_get_temp_dir())", "@is_writeable(realpath($_ENV[\"TMP\"]))", "@is_readable(realpath(@ini_get(\"upload_tmp_dir\")))", "@is_writeable(realpath($_ENV[\"TEMP\"]))", "@is_readable($_ENV[\"TMP\"])", "@is_readable($_ENV[\"TMPDIR\"])", "@ini_get(\"upload_tmp_dir\")", "@is_writeable(sys_get_temp_dir())", "@is_readable(realpath(dirname($tempfile)))", "@is_writeable(realpath(@ini_get(\"upload_tmp_dir\")))", "@is_writeable(realpath(dirname($tempfile)))", "@tempnam(__FILE__, \"\")", "@unlink($tempfile)", "@is_writeable(realpath($_ENV[\"TMPDIR\"]))" ], "i": "micro-behaviors/os/stdio::error-suppress-prefix", "l": 3 }, { "c": 0.75, "d": "Generic $_SERVER superglobal access", "e": [ "$_SERVER" ], "i": "micro-behaviors/communications/http/request/params::server-dup", "l": 3 }, { "c": 1.0, "d": "PHP unlink function symbol", "e": [ "unlink" ], "i": "micro-behaviors/fs/delete/file::php-unlink", "l": 3 }, { "a": "T1059", "c": 0.800000011920929, "d": "Self-reference via __FILE__", "e": [ "__FILE__" ], "i": "micro-behaviors/fs/read/self::self-file-reference", "l": 3 }, { "a": "T1505.003", "c": 0.4000000059604645, "d": "PHP $_GET[...] superglobal access", "e": [ "$_GET[" ], "i": "objectives/command-and-control/backdoor/webshell/request::php-get", "l": 1, "m": "B0030" }, { "a": "T1584", "c": 1.0, "d": "PHP dynamic curl_exec call from lookup table", "e": [ "curl_exec(" ], "i": "objectives/command-and-control/dropper/delivery/seo-spam::php-dynamic-curl-exec", "l": 2 }, { "a": "T1059", "c": 0.8500000238418579, "d": "HTTP GET parameter access ($_GET)", "e": [ "$_GET" ], "i": "micro-behaviors/communications/http/request/params::get-dup", "l": 3 }, { "a": "T1505.003", "c": 0.9200000166893005, "d": "HTML tag in script body", "e": [ "\u003chtml\u003e" ], "i": "objectives/command-and-control/remote-command/shell::html-tag-present", "l": 1, "m": "B0030" }, { "c": 0.8199999928474426, "d": "fopen() with w/x/c overwrite mode", "e": [ "fopen($file, 'w'" ], "i": "objectives/impact/infect/script::php-overwrite-file-mode", "l": 1 }, { "a": "T1082", "d": "Accesses SERVER_NAME variable", "e": [ "$_SERVER['SERVER_NAME']" ], "i": "objectives/discovery/system/fingerprint/info::server-name-access", "l": 3, "m": "E1082" }, { "c": 0.8500000238418579, "d": "Checks User-Agent for crawler detection", "e": [ "$_SERVER['HTTP_USER_AGENT']" ], "i": "objectives/anti-analysis/browser-detect::check-ua-server-var", "l": 3 }, { "c": 0.699999988079071, "d": "AJAX request handler pattern", "e": [ "$_GET['update']" ], "i": "objectives/command-and-control/backdoor/webshell/ui::ajax-handler", "l": 4, "m": "B0030" }, { "a": "T1505.003", "c": 0.949999988079071, "d": "PHP eval of remotely-fetched code", "e": [ "eval", "file_get_contents" ], "i": "objectives/execution/interpreter/eval/remote::remote-code-eval", "l": 4, "m": "E1059" }, { "a": "T1505.003", "c": 0.9800000190734863, "d": "PHP backdoor using custom HTTP headers for input", "e": [ "eval", "$_SERVER['HTTP_X_FORWARDED_PROTO']" ], "i": "objectives/command-and-control/backdoor/webshell/obf-dispatch::php-header-backdoor", "l": 5, "m": "B0030" }, { "a": "T1071", "c": 0.949999988079071, "d": "PHP endpoint on suspicious domain", "e": [ "http://god.sm79.xyz/api.php", "http://god.sm79.xyz/" ], "i": "objectives/command-and-control/infrastructure/domain/tld::php-c2-endpoint", "l": 5 } ], "sha": "68cc3370410a39beafabb43b8afaa9eff1ab149952bfff0b9e80563099314385", "path": "redirecturl.php", "type": "php" } ], "tv": "d376d" } }