php-malware-analysis · Index

f1.php May 8 php-malware-analysis

18794c953f32fb52b5530d9ef37c0bab605ed01d76339ae9cb1bc511fe77558b H₅(Cm₃DbF₆Os₃Po)MdTh

100% WordPress webshell dropper

dropper2.php May 8 php-malware-analysis

7217881f0538e896c0f6be0c6177cb44e8e3c4a96d0ab5803321d8b1bcefcbec O(As₂)H₄(CmDb₃F₉Os₂)MdTh

100% PHP webshell dropper

77.72.82.12W4hkBJ5vbfQkH4AYV93EkQAAAAEfile May 8 php-malware-analysis

27d8e5129666e66f17f1108b9fe3892d8b9adcdaac28cf64f780713fae0b149d O(As₂)H₃(Db₂OsPo₂)MdTh

100% Obfuscated PHP, variable function calls

88.253.118.191WwW8U0K31WueUjjWJeLrdwAAAAo.0.file May 8 php-malware-analysis

2bb80f348c367779505efaf37314247e6f8c5f5b30cf22512bc2177ff9b55034 O₅(C₄AlAs₄ErXe)H₇(Cm₉CrDb₂F₅Os₃PoU)Md₂(Pt)Th

96% Explicit webshell with file upload

create_pss.php May 8 php-malware-analysis

3e3e01655c9d82510deb08a6c05ff5a32523b8268661ee1584185f0f8c9219ca O(As)H₄(CmDbFOs)MdTh

100% PHP webshell with command execution

create_ph33r.php May 8 php-malware-analysis

4e7fb50139f8ba67e3e1e88e8d0667a8425df53e44e63999a6ee59f5a92fc91a H₃(Cm₂DbF)MdTh

100% Ph33r webshell deployment

create_python_izo.php May 8 php-malware-analysis

5bd903078babe2a6e5f66fc01e4040830ab5f601261b5606826ebfc4a7ddbec4 H₃(DbF₃Po)MdTh

100% Webshell executes arbitrary shell commands

dc1.php May 8 php-malware-analysis

7222f36a35dcc30014186fcc6e9bd31ca4e23904213f889cfa4484c4d5343859 O₃(As₄C₄Dy)H₅(Cm₉Db₅F₁₂Os₅Po₇)MdTh

100% PHP webshell with obfuscation

izocin.php May 8 php-malware-analysis

96efbcb5eef90a19711d6d3822ce21b108350e863717c59fe0a711ca141738a7 O₄(C₈As₂DyXe)H₅(Cm₈Po₁₀DbF₅Os₄)Md₂Th

100% Full-featured PHP webshell with reverse shells

78.168.18.77VWTHiAoAAAMAAFLJThcAAAAE.0.file May 8 php-malware-analysis

df493760a1a718432ceefd32b37cc7f5bfe9723658004958f07805945d203162 O₃(C₁₂As₃Dy)H₅(Po₁₀Cm₁₂Db₂F₁₀Os₄)MdTh

100% PHP webshell with reverse shell

create_suexec.php May 8 php-malware-analysis

e5de0a288f73a1c235bd12201acfcfa2b03ece03ed0640516beb89b6adbbb7aa O₄(C₂AsIXe)H₃(CmF₂Po)Md

100% Web shell with command execution

eltelt.php May 8 php-malware-analysis

9ca42700abc4f03a66fac8fcf42edb5320d8fd637f696daf24d2f6321201a938 K₂(McTe)O₄(CDyAsXe)H₅(Cm₁₁Db₃F₃Os₃Po₄)MdTh

100% WSO webshell with C2

154.48.243.123XHNOqcveF-qdhdBRjMorxAAAAAM.0.file May 8 php-malware-analysis

d7b338544ad6862168d4e6dc20d37f8e26eb4c2c11723d2f2a9954f842976354 O₄(AsC₂IXe)H₅(Cm₃Db₃F₆Os₂Po)Md

100% Web shell dropper with C2

dc1.php May 8 php-malware-analysis

de0302cc924e8cb36f95f11a3cd2c9bb8c6c6f194dbaacdcc7e71f7f154910a1 O(As₂)H₄(CmDb₃F₉Os₂)MdTh

100% PHP webshell with obfuscated payload

webroot.php May 8 php-malware-analysis

05840f71b79bd908ac887918046e4cf00b2bc3f6d43e594e70173f4909f278b1 O₂(CAs)H₅(Cm₆Db₆F₁₂Os₇Po₄)Md₂Th

100% PHP webshell with backdoor

xyz.php May 8 php-malware-analysis

720396d0af6d8e758acf6096a381fa7f82196872016b447c0ea2d2e9c454f7ca O₂(CAs)H₅(Cm₈Db₇F₁₂Os₇Po₄)MdTh

100% WebRooT webshell with backdoors

dropper.php May 8 php-malware-analysis

926034e2fbffb5bbf065c983bb74020fed3db9a8b0c55860df066385a7c0af2b O(C₂)H₄(Cm₂Db₂F₃Os)Md

100% Dropper writes webshell via base64

final.webrot.php May 8 php-malware-analysis

b7cf688c973927b763f9b73a8cef604c52e1feca59391dcc8ec2e2e70a9a2f15 O₂(CAs)H₅(Cm₈Db₇F₁₂Os₇Po₄)Md₂Th

100% WebRooT webshell with backdoors

198.98.123.140WwuYHLSEIhWj1AhdpgDD5gAAAAY.0.file May 8 php-malware-analysis

f404fbb723f050bd72cbcfda848f36be443164571584433820677d82b8ecd2dc O₂(CAs)H₃(Po₂Cm₂Os)MdTh

100% PHP webshell with obfuscated payload

dc1.php May 8 php-malware-analysis

0c0c11bd22b0181a293df915c40f24b7ca09bf868af0454bc2308135c7973f30 O₃(As₄C₄Dy)H₅(Cm₉Db₅F₁₂Os₅Po₇)MdTh

100% PHP webshell with obfuscation

18.222.103.133WqvXLekLitkX3G-vql5EDAAAAAQ.0.file May 8 php-malware-analysis

1f4002b1f0d07548e1eea5e7726841c5ecc002959c1437d1090feaba04c2ba01 O₄(I₃AsDyEr)H₆(Cm₅Cr₂DbF₃Os₃Po)Md₃(Bi₂He)Th

100% Contains cryptominer binary

session.tgz May 8 php-malware-analysis

28c67788cee1465da5fd2033358219011e620920da6d884cf9ae7667bd55a977 O₄(C₇As₅ErI)H₆(Db₄Cm₁₅F₉Os₂Po₅U)Md₂Th

99% PHP webshell with command execution

dc2.php May 8 php-malware-analysis

618a6567894d25e575b0a378e66453cc1db7d98c5f815cbe424d2ead55ac202c K(Mc)O₄(C₃CaAsDy)H₆(Db₈F₁₁Po₈Cm₁₀CrOs₁₂)MdTh

100% WSO PHP webshell with eval and file management

dc1.php May 8 php-malware-analysis

701ef77fc84bd63b0f0cd7425db461b523de0c5898900a3fd3d174701018568a O₂(AsC)H₂(Db₂Po)MdTh

100% Obfuscated webshell payload

fx2.php May 8 php-malware-analysis

d30d32e4264a8d76f70d4309559e8a4f7052708c9db5d38be60e5501cbdd60f0 K(Mc)O₆(C₉AsErEuXeDy)H₇(Po₁₀Cm₉CrDb₄F₈Os₃U)MdTh

f1.php May 8 php-malware-analysis

f02ac702d8a59e3c8a4bde4c41c05b474d15863b555cdb09f1e1148c659377c4 K(Am)O₆(C₁₂AsErCaI₂Xe)H₆(Cm₁₉CrDb₅F₁₉Os₈Po₄)Md₂(Pt)Th

100% Full-featured PHP webshell

dc1.php May 8 php-malware-analysis

2fd2de163b48c320fa2706f288270de868816a5f6b5005135c64c6b296a17118 O(C)H₅(PoCmDbFOs)MdTh

100% Webshell drops Monero miner

dc1.php May 8 php-malware-analysis

838ff271b430c28b9f74553f5ca32266427f6fc34e237ca1a08639c0a2088e7e O₂(CI)H₄(Cm₂Db₂F₄Os)Md

100% Webshell with file write

b64d.php May 8 php-malware-analysis

f805913cb85626cbb555676b09225a89e2a126e11051d9720540fceba237db7c O(C₂)H₅(PoCmDbFOs)MdTh

100% PHP webshell with eval payload

dc1.php May 8 php-malware-analysis

9211a9c079385d3f7c4f4cebaec02e2be9bd5b067c10c54b91b7b4de96b62d9a O(As)H₆(Cm₂CrDb₂F₃Os₃Po₂)Md

100% Webshell with obfuscation and evasion

dc1.php May 8 php-malware-analysis

b32abc7eb7514f3c0bc6989c91760367fd822d1d66425a959a4f569b183cdace K(Mc)O₂(C₂Xe)H₆(Cm₆DbF₂Os₃Po₃U)MdTh

100% PHP webshell with obfuscated payload

create_ftpcrack.php May 8 php-malware-analysis

2a9c412c05c2cd6ed53de00abc24214a4e721e5d1561d1cede1a082449a4d968 H₄(Cm₃DbF₂Os)MdTh

100% FTP cracker webshell payload

132.148.141.38WueV3S6ZJPxgj6V-M8HDrgAAAAE.wso.scans May 8 php-malware-analysis

41b9fddcf0e157797a78bdcaa33daa60b2881fcf7d372220a58de0b0677f2241 H(Db)MdTh

100% PHP webshell with encoded payload

176.9.85.238WjPLsUCfPlEobaz5xvIP1wAAAAs.wso.scans May 8 php-malware-analysis

4f512c5aa5b9f104dead4434cc0cb8aba2c80d7b302b4f1c86b6eda5943c18d0 H₂(Cm₂Db)MdTh

100% PHP webshell with encoded payload

154.34.28.155WqumnOGH 2EX09hGyTsSYgAAAAM.wso May 8 php-malware-analysis

583fea9059db017c4d5fd6385c146ae710c92bf83760270f6feba96aca523423 H(Db)MdTh

100% PHP webshell with encoded payload

create_perltools.php May 8 php-malware-analysis

73ee810b4c3f2f88bfb56eecb5354e64a0451fb7e9774f357c18a650987a9df3 O(As)H₃(Cm₂DbF)MdTh

100% Webshell with encoded payload

198.23.60.134WlqNOomxCp9ysn-d0cFKEgAAAAg.wso.scans May 8 php-malware-analysis

867ccd5ca98a2d8af797f445957e4466a203ef88068d2b7459b7ed10705cf243 H(Db)MdTh

100% PHP webshell with encoded payload

188.166.6.154Wx3NkqM4vfyrZi53F@xdJQAAAAsfile May 8 php-malware-analysis

b7a2cf734091efe03f17feda1409acf8a485d7d3d0b44ee9157b151ea3c8ac36 O₃(C₃As₄I)H₅(F₉Cm₄Db₃OsPo₂)Md₂

100% Obfuscated PHP webshell backdoor

151.80.84.20 May 8 php-malware-analysis

3bb7ab66f77c1cf3690365fc44978b9c5ddeb04b7c732ac2d60a9f9f080a13ce O(Er)H₄(Cm₆DbFPo₂)Md₃(InPt)

100% identity/process-title

222.214.69.105WnOmWA3c40ZzVV95DsQ4ugAAAAQ.0.file May 8 php-malware-analysis

0171f6ec5ef0d8b32a88e847d7a9892b373a96f66b808daf25e4e5819966c65a O(C)H₃(CmF₂Os)Th

99% PHP upload backdoor webshell

dir.py May 8 php-malware-analysis

87d70b7a525b3997332dadf49869c825295efa91ce15f2327e3fc88288a5f70d O₃(C₃As₂La)H₆(Cm₁₃Po₂Db₃F₂OsTi)Md

100% WordPress brute-force and webshell dropper

dc1.php May 8 php-malware-analysis

176fd81fcad0882ddd67b57325b5b5ba94dcf774fbc870af6b09bc6c47442a0c O₂(CAs)H₆(Cm₆CrDb₃F₉Os₂Po₂)MdTh

100% PHP webshell dropper

dc1.php May 8 php-malware-analysis

72a62eee29bbc8cb6ba37b7ca547ec3dc290b8ed78ed18b3fe97a0e1a26e5c36 O₃(As₂CI)H₄(Cm₅DbF₆Os₂)MdTh

100% PHP webshell with base64 payload

139.195.26.25Wh0GWEY3NM25gFX@[email protected] May 8 php-malware-analysis

1c3640ecb1c039794618a50227689e0d43ce471d502e1d9982357a840e59fd0e K₂(AmTe)O₉(C₁₃PAs₂ErCaDyI₃SXe)H₇(Os₁₀Cm₂₂CrDb₆F₁₉Po₆U)Md₃(Pt)Th₂

100% IndoXploit webshell backdoor

WebShell_d6d668b5a915eb9094e986d3abec24b805e66fff.php Apr 24 php-malware-analysis

7caf9209d10c138bb8c1b63f4cc004f0d1f838398823907b25685c7b22e62f74 O₂(As₂C)H₃(DbOsPo)Th

100% Obfuscated PHP webshell