0

My friend asked me why his website seems weird on Google and why meta title seems to be “トリプルフローアイロン”.

After checking request logs on his hosting panel and checking files on FTP, it’s clear that the website was hacked by someone who wants to position their product / website using unethical methods. Some files (like index.php or ArASEYYo.php in the root folder) have been decrypted, but CyberChef didn’t seem to help with decrypting / deobfuscate the file. My goal is to decrypt these files to see what other files are linked to it and delete all of them (deleting single file doesn’t change a thing, it appears again). Also we want to find the attacker.

Where should I search for the solutions? I’ve only used “CyberChef” and "unPHP" to try decrypting it but it didn't work, are there any other tools you guys recommend?

Improve this question
New contributor
P P is a new contributor to this site. Take care in asking for clarification, commenting, and answering. Check out our Code of Conduct.
5
  • 5
    This question is similar to: How do I deal with a compromised server?. If you believe it’s different, please edit the question, make it clear how it’s different and/or how the answers on that question are not helpful for your problem.
    – vidarlo
    Commented Dec 11 at 14:31
  • 4
    Nuke it from orbit and restore from backup, and make sure that you patch everything. Such attacks are automated, attributing them are nearly meaningless and removing all traces nigh on impossible.
    – vidarlo
    Commented Dec 11 at 14:32
  • 2
    There is a massive difference between an "encrypted" page and an "obfuscated" page. Which is it? The answer will determine what you need to do...
    – schroeder ♦
    Commented Dec 11 at 16:32
  • 1
    security.stackexchange.com/questions/115461/…
    – schroeder ♦
    Commented Dec 11 at 16:34
  • 1
    There's no universal way to deobfuscate a piece of code. PHP is generally quite easy to deobfuscate but if you cannot do it, just be honest with your friend and recommend hiring a professional if needed. If you need help, you need to at least provide the code. As a personal note, you seem unprepared to deal with this simple attack. Just swallow the pill and follow the advice of vidarlo.
    – Margaret Bloom
    Commented 2 days ago

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .