cli_code.txt

PHP

HOSTILE

Mal-ecule

Size 67.8 KB download

First seen 117 days ago

Analyzed 115 days ago

Ecosystem malcontent-samples

Objectives

command-and-control/backdoor PHP RAT with process masquerading

evasion/self-delete Recursive directory deletion in PHP (self-delete)

execution/interpreter/eval Error-suppressed eval (@eval)

impact/infect Detects delete-and-recreate file pattern

anti-static/obfuscation Single very long line (webshell

discovery/system Accesses PHP_OS constant (OS detection)

evasion Checks if exec functions exist

process/control PHP daemonization pattern

communications/http HTTP request via file_get_contents

fs/delete PHP rmdir function symbol

fs/enumerate PHP scandir function symbol

fs/write File write via fwrite

os Disables error reporting (error_reporting(0))

process/create/shell Shell command execution via passthru()

process/interpreter PHP eval() token present

file-extension-mismatch File extension claims Text but content is Php

encoded-payload Encoded payload detected: base64

SigBase/WEBSHELL/PHP PHP webshell which directly eval()s obfuscated string

SigBase/WEBSHELL/PHP/Base64/Encoded php webshell containing base64 encoded payload

SigBase/WEBSHELL/PHP/Dynamic PHP webshell using $a($code) for kind of eval with encoded blob to decode, e.g. b374k

20 of 31 traits shown

SHA-256	60c71dc626fbf248b85f9cacbd3768fa6e163017621bac31acc49ca1dd2cd436
Filename	cli_code.txt

Not seeing what you expected? Let us know