#!/bin/bash

echo 'Another abuse:'
find ./ -name '*.php' | xargs -d'\n' egrep -sl 'PCT4BA6ODSE_|\@\$_COOKIE' 
find ./ -name '*.php' -exec fgrep -l 'echo @$GLOBALS' {} \;
find ./ -name '*.php' -exec fgrep -l "'t';@\$c" {} \;
echo

echo 'Obfuscated code:'
find ./ -name '*.php' | xargs egrep -sonl '[0-9a-zA-Z]{100}' --exclude={*template.php,*/archive/tar.php,*/archive/zip.php,*bitrix/cache*} 
echo

echo 'StealRat'
find ./ -name '*.php' | xargs -d'\n' grep -so 'die(PHP_OS.chr(49).chr(48).chr(43).md5(0987654321' 
echo

echo 'CryptoPHP:'
find . -type f -regex ".*\.\(jpg\|jpeg\|gif\|png\|JPG\|JPEG\|GIF\|PNG\)" -exec grep -IEo "php.{0,80}" {} \; -print 
echo
