Recently my php-based website got infected with malware (probably by a stolen ftp password).
Basically, every 30 minutes a file frame_cleaner_php.php was uploaded, a HTTP-GET was done on it to execute it and it was removed. I was able to intercept a copy of the file and analyze it.
It was not obfuscated in any way and was quite easy to read.
In essence it recursively scanned all php-files, looked for 20 signatures of infections by common other malware (like
<?php eval(base64_decode(" or
<?PHP # Web Shell by oRb) and crudely removed the lines with that infection.
Because of a false positive some lines in my own php files where removed causing the site the go down. This was probably just an unintended side effect of the malware.
The big question: why would malware do this, what is there to gain?