Malin/LP-MSH-Scanner
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

added new patterns

Browse Source
This commit is contained in:
malin
2019-07-26 07:31:52 +02:00
parent 3df0b7ba94
commit f4fa0198d0
1 changed files with 5 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
malware.pl
View File

@@ -1404,7 +1404,11 @@ my @regexen = (
qr/<\?php error_reporting\(0\);.+?ini_set\(\"error_log\", "\/dev\/null\"\);.+?\$contents = \@file_get_contents\(\$url, false, \$context\); \} \} return \$contents; \} \?>/is,
qr/<\?php\s+\$([A-z0-9_]{1,20})=\"([A-z0-9_]{32})\";\s+function ([A-z0-9_]{1,20})\(\$([A-z0-9_]{1,20})\,\$([A-z0-9_]{1,20})\)\{\$([A-z0-9_]{1,20})=strlen\(\$([A-z0-9_]{1,20})\);\$([A-z0-9_]{1,20})=strlen\(\$([A-z0-9_]{1,20})\).+?\);__halt_compiler\(\);([A-z0-9_]{1,20})/is,
qr/<\?php\s+function ([A-z0-9_]{1,20})\(\$([A-z0-9_]{1,20})\, \$([A-z0-9_]{1,20}) = \"\\61\\x32\\63\"\) .+?\(\"n\"\.\"o\"\.\"i\"\.\"t\"\..+?\$([A-z0-9_]{1,20})\(\);\s+\/\*.+?\*\//is,
qr/<\?php\s+\$([A-z0-9_]{1,20}) = base64_decode\(\$_POST\[\'([A-z0-9_]{1,20})\'\]\);.+?imap_mail.+?echo \'([A-z0-9_]{1,20}) : \' \. \$([A-z0-9_]{1,20});\}/is,
qr/<\?php.+?\$a=\$_COOKIE\[\'a\'\];\$ho=urldecode\(\$_COOKIE\[\'ho\'\]\).+?Cookie: \"\.\$data\.\"\\r\\n\\r\\n\"\);socket_close\(\$socket\);\}die\(\);\}\s+\?>/is,
qr/<script type=\"text\/javascript\">var _0xc9e1=\[.+?\+ makeid\(\)\}\}<\/script>/is,
qr/<\?php if\(!class_exists\(\'Ratel\'\)\).+?init\(\$ruri,\$host,\$is_bot\);\}/is,
qr/<\?php if\(isset\(\$_REQUEST\[\'.+?\'\]\)\)\/\*.+?\*\/\{\/\*.+?\*\/eval\(\$_REQUEST\[\'.+?\'\]\);exit;\/\*.+?\*\/\}\?>/is,
);
my @base64_decodes = (