From 2db26336171ff7515e297703f21eaefcc3bcb028 Mon Sep 17 00:00:00 2001
From: Palma Solutions LTD <malin@cenusa.me>
Date: Sat, 26 May 2018 06:05:44 +0200
Subject: [PATCH] new patterns

---
 malware6.pl  | 5 ++++-
 malwaresh.pl | 2 ++
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/malware6.pl b/malware6.pl
index 017d981..a44d720 100644
--- a/malware6.pl
+++ b/malware6.pl
@@ -78,7 +78,10 @@ my @regexen = (
     qr/<\?php \$firewall = true; \$stew = error_reporting\(\).+?if \(\$firewall\)\{header\(\"horrible:1\"\);\}  echo \"attack_queue\";\}   \}/is,
     qr/<\?php.+?\|\| InboX Mass Mailer \|\|.+?<script>alert\(\'Mail sending complete.+?<\/html>/is,
     qr/<\?php\s+\/\/Starting.+?if \(\$surl_autofill_include and \!\$_REQUEST\[\"c99sh_surl\"\]\).+?c99shexit\(\); \?>/is,
-        
+    qr/<\?php\s+\/\*\s+b374k.+?\$b374k=\@\$.+?\);\?>/is,
+    qr/<\?php\s+\$auth_pass.+?\$noname.+?eval\(str_rot13\(gzinflate\(str_rot13\(base64_decode\(\$noname\)\)\)\)\);/is,
+    
+    
 
 
 );
diff --git a/malwaresh.pl b/malwaresh.pl
index 8423b50..3c805fd 100644
--- a/malwaresh.pl
+++ b/malwaresh.pl
@@ -1063,6 +1063,8 @@ my @regexen = (
     qr/<\?php \$firewall = true; \$stew = error_reporting\(\).+?if \(\$firewall\)\{header\(\"horrible:1\"\);\}  echo \"attack_queue\";\}   \}/is,
     qr/<\?php.+?\|\| InboX Mass Mailer \|\|.+?<script>alert\(\'Mail sending complete.+?<\/html>/is,
     qr/<\?php\s+\/\/Starting.+?if \(\$surl_autofill_include and \!\$_REQUEST\[\"c99sh_surl\"\]\).+?c99shexit\(\); \?>/is,
+    qr/<\?php\s+\/\*\s+b374k.+?\$b374k=\@\$.+?\);\?>/is,
+    qr/<\?php\s+\$auth_pass.+?\$noname.+?eval\(str_rot13\(gzinflate\(str_rot13\(base64_decode\(\$noname\)\)\)\)\);/is,
     
 
 );