From ba19eb9d627f01816b0e408dffd18a3bdf0fadd4 Mon Sep 17 00:00:00 2001 From: Palma Solutions LTD Date: Thu, 17 May 2018 21:42:59 +0200 Subject: [PATCH] new patterns --- malware6.pl | 6 ++++++ malwaresh.pl | 8 ++++++++ 2 files changed, 14 insertions(+) diff --git a/malware6.pl b/malware6.pl index 6ba9ffa..39b018a 100644 --- a/malware6.pl +++ b/malware6.pl @@ -42,6 +42,12 @@ my @regexen = ( qr/<\?php if \(\$_SERVER\[\'QUERY_STRING\'\] != \"passw0rd\"\) \{.+?\$uploadfile = \$uploaddir \. basename\(\$_FILES\[.+?\$numemails mail\(s\) was sent successfully\'\); <\/script>\";.+?\?>\s+<\/body>\s+<\/html>/is, qr/\@ini_set\(\'display_errors\', \'0\'\);.+?if \(!\$npDcheckClassBgp\) \{.+?str_replace\(\'([A-z0-9_]{1,20})\', \'bas\'.+?str_replace\(\'([A-z0-9]{1,20})\', \'64\'.+?function wp\_cd\(\$fd, \$fa=\"\"\).+?fwrite\(\$hdl, \"<\?php\\n\$mtchs\[1\]\\n\?>\"\);.+?\$npDcheckClassBgp = \'([A-z0-9]{1,20})\';\s+\}/is, qr/.+?\s+