Table of Contents

The page title is “PHP File Manager Mini” and the file is 53,271 bytes. Like UCHIHA RAJON it is run through a goto obfuscator (<?php goto gULgC; jsdh_: ?>), so the order of the code in the file is not the order it runs.

Screenshot of the shell running live in an offline sandbox, on a dummy WordPress site with invented accounts, domains and files.

What It Does#

The menu is a row of links: Home, Jumping, Symlink, Auto edit user, Config, Command, Adminer, Logout. Around it are the file list and these forms:

• Edit, rename, chmod, delete, download. Standard file actions, with a FILE EDITOR box.
• Multimass. A form with a choice of Massdeface or Massdelete, a target file name (default index.php) and a text box: it writes the same content to a file name in every folder, or removes them. The text says “if you used Massdelete please empty the text”.
• Upload in two modes (biasa and home_root).
• Command. exe() runs a command with system, falling back to exec, passthru and the other functions if one is disabled.
• Symlink, Jumping, Auto edit user, Config. Labels in the menu. In shells of this type they are used on shared hosting to link other accounts’ files into the web root and read their config files. I did not trace this file’s code for them, so I am only reporting the labels.
• Adminer and a gzinflate call for a compressed extra.
• Logout. A function that drops a session value named md5(...). There is no login screen.

Detection & Cleanup#

# strings from this file
grep -rlF -e 'PHP File Manager Mini' -e 'Multimass' .

• Mass operations leave a pattern: the same file (often index.php) with the same new content in many folders. find . -name index.php -newer <date> -exec sha256sum {} + | sort | uniq -c -w64 | sort -rn | head shows one hash repeated across folders.
• The goto layout is searchable: grep -rlE '^<\?php goto [A-Za-z0-9_]{5};' --include='*.php' ..

IOCs#

File      80ea2acac7f1af0cc3ebaaba656224c8   53,271 bytes
sha256    e8eb5bddb7962ef2b71566cf3d757e8cc6057b048859bc59863bc69a9417f11c
md5       8363f2c63baf260d5941699d725ed982
Strings   "PHP File Manager Mini"   '<?php goto gULgC;'   massdeface   massdelete   Multimass   "Auto edit user"