Malin/LP-MSH-Scanner
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

new patterns

Browse Source
This commit is contained in:
Palma Solutions LTD
2018-10-08 10:17:06 +02:00
parent 953b4dc786
commit a51e03a3bc
2 changed files with 3 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
malware6.pl
View File

@@ -337,7 +337,8 @@ my @regexen = (
qr/<\?php.+?\*\/\s+\$lyrics3size=\'\'\.\'b\'\.\'\'\.\'a\'\.\'\'\.\'se\'\.\(8768\/137\)\.\'_de\'\.\'\'\.\'c\'\.\'\'\.\'ode\';\s+\$lyrics3sizeV2 = \"ass\"; \$lyrics3sizeV2 \.= \"ert\"; \@\$lyrics3sizeV2\(\$lyrics3size\(.+?\} \*\//is,
qr/<\?php \$([A-z0-9_]{1,20}) = array\(.+?array\(\'b\' ,\'a\' ,\'s\' ,\'e\' ,\'6\' ,\'4\' ,\'_\' ,\'d\' ,\'e\' ,\'c\' ,\'o\' ,\'d\' ,\'e\'\); \$([A-z0-9_]{1,20}) = array\(\'gzu\', \'nco\', \'mpr\', \'ess\'\) ;\$.+?\) \) \) \) ; \?>/is,
qr/<\?php \$user_agent_to_filter = array\( \"\#Ask\\s\*Jeeves\#i\", \"\#HP\\s\*Web\\s\*PrintSmart\#i\",.+?\$result = curl_exec\(\$ch\);\s+curl_close \(\$ch\);\s+echo \$result;\}\?>/is,
qr/<script language=javascript>var _0xfcc4=\[\"\\x66.+?true\)\{a\(\)\}\}<\/script>/is,

1
malwaresh.pl
View File

@@ -1324,6 +1324,7 @@ my @regexen = (
qr/<\?php.+?\*\/\s+\$lyrics3size=\'\'\.\'b\'\.\'\'\.\'a\'\.\'\'\.\'se\'\.\(8768\/137\)\.\'_de\'\.\'\'\.\'c\'\.\'\'\.\'ode\';\s+\$lyrics3sizeV2 = \"ass\"; \$lyrics3sizeV2 \.= \"ert\"; \@\$lyrics3sizeV2\(\$lyrics3size\(.+?\} \*\//is,
qr/<\?php \$([A-z0-9_]{1,20}) = array\(.+?array\(\'b\' ,\'a\' ,\'s\' ,\'e\' ,\'6\' ,\'4\' ,\'_\' ,\'d\' ,\'e\' ,\'c\' ,\'o\' ,\'d\' ,\'e\'\); \$([A-z0-9_]{1,20}) = array\(\'gzu\', \'nco\', \'mpr\', \'ess\'\) ;\$.+?\) \) \) \) ; \?>/is,
qr/<\?php \$user_agent_to_filter = array\( \"\#Ask\\s\*Jeeves\#i\", \"\#HP\\s\*Web\\s\*PrintSmart\#i\",.+?\$result = curl_exec\(\$ch\);\s+curl_close \(\$ch\);\s+echo \$result;\}\?>/is,
qr/<script language=javascript>var _0xfcc4=\[\"\\x66.+?true\)\{a\(\)\}\}<\/script>/is,