diff --git a/malware4.pl b/malware4.pl index f14a978..c6e3f4b 100644 --- a/malware4.pl +++ b/malware4.pl @@ -226,6 +226,11 @@ my @regexen = ( qr/<\?php\s+echo\s+\"Priv8\s+Home\s+Root\s+Uploader.+?echo\s+\"gagal\s+upload\"\;\s+\}\s+\}\s+\}\s+\?>/is, qr/<\?php.+?BlackHat\s+Shell.+?\$auth\_pass.+?\$nusantarablackhat.+?eval\(str\_rot13\(gzinflate\(str\_rot13\(base64\_decode\(\(\$nusantarablackhat\)\)\)\)\)\)\;/is, qr/<\!DOCTYPE\s+html>\s+\s+<\!\-\-\s+Meta\s+\-\->\s+.+?<\!\-\-\s+end\:\s+index\s+\-\->/is, + qr/\s+\s+\?\?\?\!\!\!<\/title>.+?<h1>\s+HACKED\s+BY\s+CYBERSCRY\s+<\/h1>.+?\/font><\/marquee><br><br><br>/is, + qr/<\?php\s+\/\/silent\s+is\s+gold\s+eval\(str\_rot13\(gzinflate\(str\_rot13\(base64\_decode\(.+?\)\)\)\)\)\;\s+\?>/is, + qr/<\?php\s+\/\/silent\s+is\s+gold\s+eval\(gzinflate\(base64\_decode\(.+?\)\)\)\;/is, + + ); my @base64_decodes = (