Malin/LP-MSH-Scanner
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

new pattern

Browse Source
This commit is contained in:
Palma Solutions LTD
2017-07-30 06:37:14 +02:00
parent ff656c2df9
commit 2c722a9f56
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
malware4.pl
View File

@@ -158,7 +158,7 @@ my @regexen = (
qr/<\?php\s+function\s+([A-z0-9]{1,20})\(\$([A-z0-9]{1,20})\).+?\$([A-z0-9]{1,20})\=array\(\)\;\s+foreach\(\$\_SERVER\s+as\s+\$([A-z0-9]{1,20}).+?if\(\!empty\(\$this\->([A-z0-9]{1,20})\)\)return\s+\$this\->([A-z0-9]{1,20})\;\s+return\s+false\;\s+\}\s+\}\s+\?>/is,
qr/<\?php\s+if\/\*([A-z0-9]{1,20})\*\/\(isset\(\$\_REQUEST\[\'([A-z0-9]{1,20})\'\]\)\)\/\*([A-z0-9]{1,20})\*\/\{\/\*([A-z0-9]{1,20})\*\/\$([A-z0-9]{1,20})\/\*([A-z0-9]{1,20})\*\/\=\"ass\"\.\"ert\"\;\/\*([A-z0-9]{1,20})\*\/\$([A-z0-9]{1,20})\=\$([A-z0-9]{1,20})\/\*([A-z0-9]{1,20})\*\/\(\/\*([A-z0-9]{1,20})\*\/\$\_REQUEST\[\'([A-z0-9]{1,20})\'\]\)\;exit\;\/\*([A-z0-9]{1,20})\*\/\}\s+echo\s+([0-9]{1,20})\+([0-9]{1,20})\;\?>/is,
qr/<\?php\s+\$([A-z0-9]{1,20})\=.+?\$([A-z0-9]{1,20})\=str\_replace\(\"\[t1\]\"\,.+?include\(\"temp1\-1\.php\"\)\;\s+fclose\(\$([A-z0-9]{1,20})\)\;\s+\$([A-z0-9]{1,20})\=fopen\(\"temp1\-1\.php\"\,\"w\"\)\;\s+fclose\(\$([A-z0-9]{1,20})\)\;\s+\?>/is,
qr/<\?php\s+\@session\_start\(\)\;.+?\/\/PASSWORD\s+CONFIGURATION.+?\=strrev\(\'edoced\_46esab\'\)\;\$s\=gzinflate\(\$.+?\)\;create\_function\(\'\'\,\"\}\$s\/\/\"\)\;\s+\?>/is,