From a068dcde134f7d9bdf968e339811a90d0eb2b9c9 Mon Sep 17 00:00:00 2001 From: Palma Solutions LTD Date: Fri, 15 Sep 2017 21:14:26 +0200 Subject: [PATCH] new pattern --- malware4.pl | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/malware4.pl b/malware4.pl index 889a37e..cd717c6 100644 --- a/malware4.pl +++ b/malware4.pl @@ -173,7 +173,7 @@ my @regexen = ( qr/<\?php\s+\$cfg\=.+?\)\)\{echo\s+\$goto\_body\;\}\s+\?>/is, qr/<\!DOCTYPE.+?404.+?<address>Apache\/2\.4.+?<\/html>/is, qr/<\?php\s+\$([A-z0-9]{1,20})\=\"([A-z0-9]{1})\"\.chr\(.+?\.chr\(.+?\.chr\(.+?\.chr\(.+?\.chr\(.+?\.chr\(.+?\.chr\(.+?\.chr\(.+?\.chr\(.+?\.chr\(.+?\.chr\(.+?\)\;\s+\?>/is, - + qr/<\!DOCTYPE\s+html>\s+<html\s+lang\=\"en\-us\"><head><title>Hacked\s+by\s+AnoaGhost.+?<\/html>/is, ); my @base64_decodes = (