1

I found this backdoor on a client's website.

https://github.com/baogiaphucthinh/Malicious-php/blob/main/1259da6sc.php (original file)

I have gotten rid of it and realise it's an obfuscated script but how can I deobfuscate it in order to get to the root of this matter and understand the motive behind this attack better?

Thanks!

Improve this question
4
  • it looks like the main part is gzip compressed so try decompress to remove the obfuscation (at least the first layer)
    – Paweł Łukasik
    Jun 21, 2021 at 17:38
  • thank you, i think he use TinyObfuscate, i saw the character is same same but i cant decode it
    – Joey Doe
    Jun 22, 2021 at 6:22
  • So what's underneath gzip layer? Either it's done (post an answer) or if not update the question with more info.
    – Paweł Łukasik
    Jun 22, 2021 at 16:00
  • @JoeyDoe why do you think it is TinyObfuscate? I wrote TinyObfuscate and I can help you decode it.
    – Michael Haephrati
    yesterday

0

Reset to default

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.